Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 10, 2023, 9:26 a.m.	Nov. 10, 2023, 9:34 a.m.

Size	691.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3fe5e1bbb296648428c4436703bd6302`
SHA256	`3038d30e97cab8788e36b1ecf9656582c8a6aa7111820229f90dc75f61643b45`
CRC32	`C1D12FF2`
ssdeep	`12288:BMrsy90G0SA/6dsIKqNw6DZG/x+fikOYAY8eUw2oA4lV11I4I95pox2CvQG9M6:Vyk/6hKGw61UQKGAYzb2oA8VXr43G/97`
PDB Path	wextract.pdb
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file UPX_Zero - UPX packed file

smo.exe "C:\Users\test22\AppData\Local\Temp\smo.exe"
880
- mt6rj31.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\mt6rj31.exe
  2052
  - ke7tL10.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\ke7tL10.exe
    2096
    - 1fu85ka2.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\1fu85ka2.exe
      2164
      - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2252
    - 2eF9290.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\2eF9290.exe
      2380
  - 6Dj7Kk7.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\6Dj7Kk7.exe
    2436
    - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2612
- 7yr7dA09.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\7yr7dA09.exe
  2696
  - cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\is64.bat" "
    2816

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
193.233.255.73	Active	Moloch
5.42.92.51	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043233	ET INFO Microsoft net.tcp Connection Initialization Activity	Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2046045	ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	A Network Trojan was detected
TCP 5.42.92.51:19057 -> 192.168.56.103:49176	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49176 -> 5.42.92.51:19057	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2047625	ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST)	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 193.233.255.73:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 10, 2023, 9:26 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 10, 2023, 9:26 a.m.			0	0
IsDebuggerPresent Nov. 10, 2023, 9:26 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (17 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006057b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006057b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006057b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006057b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00605838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00605838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00605738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00605738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00605738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00605738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00605738 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006057b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006057b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006059b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006060f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006060f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 10, 2023, 9:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00605fb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 10, 2023, 9:26 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more processes crashed (50 out of 94172 events)

Time & API	Arguments	Status
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 5 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1937075299 registers.ebx: 0 registers.esi: 3285848 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 4 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1970365249 registers.ebx: 0 registers.esi: 3285852 registers.ecx: 3684720849	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1399157353 registers.ebx: 0 registers.esi: 3285856 registers.ecx: 1280335481	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1867274066 registers.ebx: 0 registers.esi: 3285860 registers.ecx: 4121499506	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 2017815395 registers.ebx: 0 registers.esi: 3285864 registers.ecx: 719449619	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 5 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1684370017 registers.ebx: 0 registers.esi: 3285848 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 4 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1970365249 registers.ebx: 0 registers.esi: 3285852 registers.ecx: 3684720849	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1399157353 registers.ebx: 0 registers.esi: 3285856 registers.ecx: 1280335481	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1867274066 registers.ebx: 0 registers.esi: 3285860 registers.ecx: 4121499506	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1750297443 registers.ebx: 0 registers.esi: 3285864 registers.ecx: 3771723283	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1131701057 registers.ebx: 0 registers.esi: 2029664 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1769235265 registers.ebx: 0 registers.esi: 2029668 registers.ecx: 3428016337	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1702125942 registers.ebx: 0 registers.esi: 2029672 registers.ecx: 3874855382	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1097690996 registers.ebx: 0 registers.esi: 2029664 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1097098305 registers.ebx: 0 registers.esi: 2029668 registers.ecx: 1563226577	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1466789748 registers.ebx: 0 registers.esi: 2029664 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1097098305 registers.ebx: 0 registers.esi: 2029668 registers.ecx: 1563226577	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 4 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1098080617 registers.ebx: 0 registers.esi: 3285848 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1130652737 registers.ebx: 0 registers.esi: 3285852 registers.ecx: 2133651921	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1869835887 registers.ebx: 0 registers.esi: 3285856 registers.ecx: 3447952351	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1816225132 registers.ebx: 0 registers.esi: 3285860 registers.ecx: 126205484	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 4 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1467179369 registers.ebx: 0 registers.esi: 3285848 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1130652737 registers.ebx: 0 registers.esi: 3285852 registers.ecx: 2133651921	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1869835887 registers.ebx: 0 registers.esi: 3285856 registers.ecx: 3447952351	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1816225132 registers.ebx: 0 registers.esi: 3285860 registers.ecx: 126205484	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 9 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1869901929 registers.ebx: 0 registers.esi: 3293904 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 8 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1231316033 registers.ebx: 0 registers.esi: 3293908 registers.ecx: 3844927953	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 7 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1734702190 registers.ebx: 0 registers.esi: 3293912 registers.ecx: 255660110	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 6 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 2037672306 registers.ebx: 0 registers.esi: 3293916 registers.ecx: 1526365074	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 5 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1700946252 registers.ebx: 0 registers.esi: 3293920 registers.ecx: 1783842828	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 4 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1114592364 registers.ebx: 0 registers.esi: 3293924 registers.ecx: 1158749484	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1684960623 registers.ebx: 0 registers.esi: 3293928 registers.ecx: 3222375135	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1148809825 registers.ebx: 0 registers.esi: 3293932 registers.ecx: 773132785	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1919120229 registers.ebx: 0 registers.esi: 3293936 registers.ecx: 1792035125	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 7 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1835093618 registers.ebx: 0 registers.esi: 3285848 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 6 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1281647681 registers.ebx: 0 registers.esi: 3285852 registers.ecx: 2553082321	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 5 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1818321775 registers.ebx: 0 registers.esi: 3285856 registers.ecx: 2840090847	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 4 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1702128705 registers.ebx: 0 registers.esi: 3285860 registers.ecx: 3918100945	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1952542322 registers.ebx: 0 registers.esi: 3285864 registers.ecx: 1237799058	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1836008293 registers.ebx: 0 registers.esi: 3285868 registers.ecx: 751900981	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1702131056 registers.ebx: 0 registers.esi: 3285872 registers.ecx: 642348144	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 7 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1835093618 registers.ebx: 0 registers.esi: 3285848 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 6 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1281647681 registers.ebx: 0 registers.esi: 3285852 registers.ecx: 2553082321	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 5 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1818321775 registers.ebx: 0 registers.esi: 3285856 registers.ecx: 2840090847	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 4 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1702128705 registers.ebx: 0 registers.esi: 3285860 registers.ecx: 3918100945	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1952542322 registers.ebx: 0 registers.esi: 3285864 registers.ecx: 1237799058	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1836008293 registers.ebx: 0 registers.esi: 3285868 registers.ecx: 751900981	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 1 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1702131056 registers.ebx: 0 registers.esi: 3285872 registers.ecx: 642348144	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 3 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 2020885364 registers.ebx: 0 registers.esi: 2029664 registers.ecx: 0	1
__exception__ Nov. 10, 2023, 9:26 a.m.	stacktrace: IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d _GetSpecialResolution@0-0xf6 1fu85ka2+0x17e0 @ 0x8f17e0 exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7 exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36 exception.instruction: mov al, byte ptr [ebx] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 273462 exception.address: 0x778e2c36 registers.esp: 2029520 registers.edi: 2 registers.eax: 2029564 registers.ebp: 2029580 registers.edx: 1382310977 registers.ebx: 0 registers.esi: 2029668 registers.ecx: 4264358353	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://193.233.255.73/loghub/master

Performs some HTTP requests (1 event)

request

POST http://193.233.255.73/loghub/master

Sends data using the HTTP POST Method (1 event)

request

POST http://193.233.255.73/loghub/master

Allocates read-write-execute memory (usually to unpack itself) (50 out of 106 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74011000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73522000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f0b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ee2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d0a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00861000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00862000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x706e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74711000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c3f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6de11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6ddee000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6dc6b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00863000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00864000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00865000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (6 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 2425558 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 2425558 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 2425396 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 2425396 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 2425227 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Nov. 10, 2023, 9:26 a.m.	number_of_free_clusters: 2425227 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (7 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\lockfile
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (7 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\7yr7dA09.exe
file	C:\Users\test22\AppData\Local\Temp\is64.bat
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\2eF9290.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\mt6rj31.exe
file	C:\Users\test22\AppData\Local\Temp\IXP002.TMP\1fu85ka2.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\6Dj7Kk7.exe
file	C:\Users\test22\AppData\Local\Temp\IXP001.TMP\ke7tL10.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\is64.bat

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 10, 2023, 9:26 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\is64.bat parameters: filepath: C:\Users\test22\AppData\Local\Temp\is64.bat	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000a4800', u'virtual_address': u'0x0000c000', u'entropy': 7.9211460174362935, u'name': u'.rsrc', u'virtual_size': u'0x000a5000'}

entropy

7.92114601744

description

A section with a high entropy has been found

entropy

0.952932657495

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 10, 2023, 9:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (28 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 51 events)

Time & API	Arguments	Status
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000004f4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: 7-Zip base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: AddressBook base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Adobe AIR base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Connection Manager base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: DirectDrawEx base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: EditPlus base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Fontcore base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Google Chrome base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: IE40 base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: IE4Data base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: IE5BAKEX base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: IEData base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: MobileOptionPack base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: Office15.PROPLUSR base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: SchedulingAgent base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: WIC base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW Nov. 10, 2023, 9:26 a.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x000004f4 key_handle: 0x000004d4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Nov. 10, 2023, 9:26 a.m.	status_code: 0x00000005 process_identifier: 2524 process_handle: 0x00000124		0	0
NtTerminateProcess Nov. 10, 2023, 9:26 a.m.	status_code: 0x00000005 process_identifier: 2524 process_handle: 0x00000124	1	0	0

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (2 events)

host	193.233.255.73
host	5.42.92.51

Creates an Alternate Data Stream (ADS) (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\echo:1

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2252 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000120	1	0
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2524 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000124		3221225496
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000128	1	0

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\"
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2	reg_value	rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\"

Detects Avast Antivirus through the presence of a library (2 events)

Time & API	Arguments	Status	Return	Repeated
LdrGetDllHandle Nov. 10, 2023, 9:26 a.m.	module_name: snxhk module_address: 0x00000000 stack_pivoted: 0		3221225781	0
LdrGetDllHandle Nov. 10, 2023, 9:26 a.m.	module_name: snxhk module_address: 0x00000000 stack_pivoted: 0		3221225781	0

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (8 events)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2436 manipulating memory of non-child process 2524
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2524 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000124		3221225496	0

Potential code injection by writing to the memory of another process (7 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÎ7Meà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þZB@¶B@¶B@¶B@¶B@¶BH¶B]B^BÈTBµB`°BC¶B(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB¶B,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB..þÿÿÿ þÿÿÿuLÓôk§cßÜÆí&XÔi¾üørÕ ²l¢-µsõ^}xFÝz§ÁÆ¯µ{*C]}u¸ØwÉÇiíÖ(õ[!¼h¬=Ð)ÄI\íAÙU$þ6fyôKÈ\|`@óém0Ø8v¶¤.~%âïÇ¨ÎÝ$}DÜHYØÃWæ\ÃsS?½ïGmhO3Jê¹§)ûäa/§tR¡AºÕÿê4ÿÿ° Kñ9ãÉD}E/BçGüÜgnÅÚ9ô3/çÀ4è± ßKÎóÎ3¸õxÏ´sÜz¸ãî¨7iÓUØ¶ÔHuç¢:J4Ðar0YÆA¾¼O1lKz²E½±íZJ2`Aà5²ÆÅz±0}K!tÌwþl¢T`Dñ(4UÕæ!Fæ@ÜDÔ&ÿ®\|iª¡ý-Vôü>ê;ÂxkßÀ#3J$UnT¸?µÝòg\ç4&Ú3\|Fuw¤e«ãè £èn¢±>v5å.góFÃ\|,¡9UF~£ÇÖ¡.]PÓ0ÿoÚLåÂÆC°âæêÁ'=`SËJ¤øÒ´B\|×°'ëQ(÷«¹yl)2Ô;<÷Fýä@ÊZ%×ïÅÈÄ,Qñ´=Ï£¥£PöaS;qî.Øy´}R¤à1ÔwxS±¢ RðÈ/½î5~èÛSôÆ§S½ÜÁÙ`É5Utàô¶oý«õ`6¡âòí¦a:Æ¦m!Åcà}²{îa¯Mme®2@¾@£xbÈ^¥i>JÃå)¤±JõòÓÂ3²ÝÞo<BNPòÁbVlÎ_%Ïòrøß>Ûãù´s·äîu±ü¿c\£RôKêüM¡³¾n>÷D»5Öèõ\|9!! ÊrjH«·öã^4Ì»¢ûö©[{ ÁáâàÜxÅbýD^W·Ñà§ÃêAu»vÂiâ7ÎÕèç~¨±+¹±¼ôà~\| yì8Eõ¾¹?äµ÷¼F+>`V\|B.?AVbad_exception@std@@\|B.?AVexception@std@@\|B.?AVtype_info@@ base_address: 0x0042b000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: 0 H`à}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042e000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁ ²à0À¬Þ à@ À@@ÞKàN© H.text¾ À `.rsrcN©àªÂ@@.reloc l@B base_address: 0x00400000 process_identifier: 2612 process_handle: 0x00000128	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: Ð> base_address: 0x0043a000 process_identifier: 2612 process_handle: 0x00000128	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2612 process_handle: 0x00000128	1	1

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÎ7Meà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2252 process_handle: 0x00000120	1	1	0
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁ ²à0À¬Þ à@ À@@ÞKàN© H.text¾ À `.rsrcN©àªÂ@@.reloc l@B base_address: 0x00400000 process_identifier: 2612 process_handle: 0x00000128	1	1	0

Collects information about installed applications (38 events)

Time & API	Arguments	Status
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Nov. 10, 2023, 9:26 a.m.	key_handle: 0x000004d4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2164 called NtSetContextThread to modify thread in remote process 2252
Process injection	Process 2436 called NtSetContextThread to modify thread in remote process 2612
NtSetContextThread Nov. 10, 2023, 9:26 a.m.	registers.eip: 2005598660 registers.esp: 3145168 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2252	1	0	0
NtSetContextThread Nov. 10, 2023, 9:26 a.m.	registers.eip: 2005598660 registers.esp: 3733772 registers.edi: 0 registers.eax: 4382350 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000012c process_identifier: 2612	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2164 resumed a thread in remote process 2252
Process injection	Process 2436 resumed a thread in remote process 2612
Process injection	Process 2696 resumed a thread in remote process 2816
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2252	1	0	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 2612	1	0	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 2816	1	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 55 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2056 thread_handle: 0x0000001c process_identifier: 2052 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\mt6rj31.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2700 thread_handle: 0x00000128 process_identifier: 2696 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\7yr7dA09.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2100 thread_handle: 0x0000001c process_identifier: 2096 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\ke7tL10.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2440 thread_handle: 0x00000128 process_identifier: 2436 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP001.TMP\6Dj7Kk7.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2168 thread_handle: 0x0000001c process_identifier: 2164 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP002.TMP\1fu85ka2.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000128	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2384 thread_handle: 0x00000128 process_identifier: 2380 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP002.TMP\2eF9290.exe filepath_r: stack_pivoted: 0 creation_flags: 524320 (EXTENDED_STARTUPINFO_PRESENT\|NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x0000001c	1	1
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2256 thread_handle: 0x0000002c process_identifier: 2252 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000120	1	1
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2252 region_size: 208896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000120	1	0
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELÎ7Meà$ºA@@0@L(ààðô0à @@.textô) `.rdataxa@b.@@.dataH#°@À.rsrcàà@@.relocô0ð2 @B base_address: 0x00400000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x00401000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x00424000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þZB@¶B@¶B@¶B@¶B@¶BH¶B]B^BÈTBµB`°BC¶B(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB(ÇB¶B,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB,ÇB..þÿÿÿ þÿÿÿuLÓôk§cßÜÆí&XÔi¾üørÕ ²l¢-µsõ^}xFÝz§ÁÆ¯µ{*C]}u¸ØwÉÇiíÖ(õ[!¼h¬=Ð)ÄI\íAÙU$þ6fyôKÈ\|`@óém0Ø8v¶¤.~%âïÇ¨ÎÝ$}DÜHYØÃWæ\ÃsS?½ïGmhO3Jê¹§)ûäa/§tR¡AºÕÿê4ÿÿ° Kñ9ãÉD}E/BçGüÜgnÅÚ9ô3/çÀ4è± ßKÎóÎ3¸õxÏ´sÜz¸ãî¨7iÓUØ¶ÔHuç¢:J4Ðar0YÆA¾¼O1lKz²E½±íZJ2`Aà5²ÆÅz±0}K!tÌwþl¢T`Dñ(4UÕæ!Fæ@ÜDÔ&ÿ®\|iª¡ý-Vôü>ê;ÂxkßÀ#3J$UnT¸?µÝòg\ç4&Ú3\|Fuw¤e«ãè £èn¢±>v5å.góFÃ\|,¡9UF~£ÇÖ¡.]PÓ0ÿoÚLåÂÆC°âæêÁ'=`SËJ¤øÒ´B\|×°'ëQ(÷«¹yl)2Ô;<÷Fýä@ÊZ%×ïÅÈÄ,Qñ´=Ï£¥£PöaS;qî.Øy´}R¤à1ÔwxS±¢ RðÈ/½î5~èÛSôÆ§S½ÜÁÙ`É5Utàô¶oý«õ`6¡âòí¦a:Æ¦m!Åcà}²{îa¯Mme®2@¾@£xbÈ^¥i>JÃå)¤±JõòÓÂ3²ÝÞo<BNPòÁbVlÎ_%Ïòrøß>Ûãù´s·äîu±ü¿c\£RôKêüM¡³¾n>÷D»5Öèõ\|9!! ÊrjH«·öã^4Ì»¢ûö©[{ ÁáâàÜxÅbýD^W·Ñà§ÃêAu»vÂiâ7ÎÕèç~¨±+¹±¼ôà~\| yì8Eõ¾¹?äµ÷¼F+>`V\|B.?AVbad_exception@std@@\|B.?AVexception@std@@\|B.?AVtype_info@@ base_address: 0x0042b000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: 0 H`à}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042e000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x0042f000 process_identifier: 2252 process_handle: 0x00000120	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2252 process_handle: 0x00000120	1	1
NtSetContextThread Nov. 10, 2023, 9:26 a.m.	registers.eip: 2005598660 registers.esp: 3145168 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2252	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2252	1	0
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2528 thread_handle: 0x00000120 process_identifier: 2524 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000124	1	1
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000120	1	0
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2524 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000124		3221225496
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x00000000 process_identifier: 2524 process_handle: 0x00000124		0
CreateProcessInternalW Nov. 10, 2023, 9:26 a.m.	thread_identifier: 2616 thread_handle: 0x0000012c process_identifier: 2612 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000128	1	1
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000012c	1	0
NtAllocateVirtualMemory Nov. 10, 2023, 9:26 a.m.	process_identifier: 2612 region_size: 245760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000128	1	0
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÁ ²à0À¬Þ à@ À@@ÞKàN© H.text¾ À `.rsrcN©àªÂ@@.reloc l@B base_address: 0x00400000 process_identifier: 2612 process_handle: 0x00000128	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x00402000 process_identifier: 2612 process_handle: 0x00000128	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: base_address: 0x0042e000 process_identifier: 2612 process_handle: 0x00000128	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: Ð> base_address: 0x0043a000 process_identifier: 2612 process_handle: 0x00000128	1	1
WriteProcessMemory Nov. 10, 2023, 9:26 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2612 process_handle: 0x00000128	1	1
NtSetContextThread Nov. 10, 2023, 9:26 a.m.	registers.eip: 2005598660 registers.esp: 3733772 registers.edi: 0 registers.eax: 4382350 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000012c process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 2612	1	0
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c	1	0
NtGetContextThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000039c suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000044c suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x0000045c suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000478 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000490 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000004c8 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000004e4 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x000004f8 suspend_count: 1 process_identifier: 2612	1	0
NtResumeThread Nov. 10, 2023, 9:26 a.m.	thread_handle: 0x00000514 suspend_count: 1 process_identifier: 2612	1	0

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
FireEye	Generic.mg.3fe5e1bbb2966484
Skyhigh	BehavesLike.Win32.Downloader.jc
McAfee	Trojan-FVTT!3FE5E1BBB296
Sangfor	Trojan.Win32.Save.a
K7GW	Trojan ( 005aad751 )
K7AntiVirus	Trojan ( 005aad751 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan-PSW.Win32.Stealerc.gen
Rising	Trojan.Generic@AI.100 (RDML:ezOOwkutQgvB/NWigGzdgw)
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	Trojan.Inject4.63861
VIPRE	Gen:Trojan.Heur.ceW@J0xm4Ql
TrendMicro	TROJ_GEN.R002C0DK923
Trapmine	malicious.moderate.ml.score
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious SFX
Google	Detected
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Win32.PossibleThreat
Kingsoft	malware.kb.a.995
Gridinsoft	Spy.Win32.Redline.lu!heur
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
ZoneAlarm	UDS:Trojan-PSW.Win32.Stealerc.gen
Microsoft	Trojan:Script/Phonzy.B!ml
Varist	W32/Kryptik.JKR.gen!Eldorado
Acronis	suspicious
ALYac	Gen:Trojan.Heur.ceW@J0xm4Ql
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.3201590363
TrendMicro-HouseCall	TROJ_GEN.R002C0DK923
Ikarus	Trojan.Win32.Crypt
Fortinet	W32/Kryptik.HUTD!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.7a6e76
Avast	Win32:PWSX-gen [Trj]

smo.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All