popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

UnityLibManager.exe

Gen1 RedLine stealer NSIS Generic Malware UPX Downloader Malicious Library Malicious Packer Javascript_Blob Anti_VM DLL ftp MSOffice File PE64 PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 27, 2023, 9:24 a.m. Nov. 27, 2023, 9:35 a.m.
Size 62.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 1cf04f58323fc1139560daee9b3d1831
SHA256 b7feec3ac7e09f20d3a1816b3c33b4ae9ad658f34186bf4f8e3e82e600780002
CRC32 99C24F7B
ssdeep 1572864:pm6nrJMEV6HPjtBGv41sZe2wxM2b+DXTKRdM60EVJ:U6rJx6HPjn3yf2yDXT360EVJ
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • NSIS_Installer - Null Soft Installer
  • ftp_command - ftp command
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
ipinfo.io
A 34.117.59.81
34.117.59.81
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefdbfa49d
??0V8StackTraceId@v8_inspector@@QEAA@_KU?$pair@_J_J@__1@std@@@Z+0xa26669 Cr_z_adler32_combine-0x6a717 unitylibmanager+0x520dd89 @ 0x14496dd89
??0V8StackTraceId@v8_inspector@@QEAA@_KU?$pair@_J_J@__1@std@@@Z+0xa26689 Cr_z_adler32_combine-0x6a6f7 unitylibmanager+0x520dda9 @ 0x14496dda9
GetMainTargetServices+0x3737e5 ??_7CommandLineAPIScope@V8InspectorSession@v8_inspector@@6B@-0x1bf381b unitylibmanager+0x5628ad5 @ 0x144d88ad5
GetMainTargetServices+0x3736f0 ??_7CommandLineAPIScope@V8InspectorSession@v8_inspector@@6B@-0x1bf3910 unitylibmanager+0x56289e0 @ 0x144d889e0
?CheckCachedDataInvariants@ExternalOneByteStringResource@String@v8@@AEBAXXZ+0xd00 ?IsCacheable@ExternalStringResourceBase@String@v8@@UEBA_NXZ-0xf70 unitylibmanager+0x30f2f10 @ 0x142852f10
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x315d52 Cr_z_adler32-0x1c03e unitylibmanager+0x37ac832 @ 0x142f0c832
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x315793 Cr_z_adler32-0x1c5fd unitylibmanager+0x37ac273 @ 0x142f0c273
Cr_z_crc32+0x3ea0ff ?Abort@WasmModuleObjectBuilderStreaming@v8@@QEAAXV?$MaybeLocal@VValue@v8@@@2@@Z-0x52071 unitylibmanager+0x3bb2faf @ 0x143312faf
uv_sleep+0x16e4a GetHandleVerifier-0x9446 unitylibmanager+0x1c964aa @ 0x1413f64aa
uv_sleep+0x16d5f GetHandleVerifier-0x9531 unitylibmanager+0x1c963bf @ 0x1413f63bf
uv_sleep+0x16ccd GetHandleVerifier-0x95c3 unitylibmanager+0x1c9632d @ 0x1413f632d
uv_fs_get_result+0x693b2f uv_os_getpid-0xe6b1 unitylibmanager+0x16e849f @ 0x140e4849f
uv_fs_get_result+0x6936a9 uv_os_getpid-0xeb37 unitylibmanager+0x16e8019 @ 0x140e48019
uv_fs_get_result+0x694078 uv_os_getpid-0xe168 unitylibmanager+0x16e89e8 @ 0x140e489e8
Cr_z_crc32+0x9c75f ?Abort@WasmModuleObjectBuilderStreaming@v8@@QEAAXV?$MaybeLocal@VValue@v8@@@2@@Z-0x39fa11 unitylibmanager+0x386560f @ 0x142fc560f
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x302aa8 Cr_z_adler32-0x2f2e8 unitylibmanager+0x3799588 @ 0x142ef9588
Cr_z_crc32+0x19e79d ?Abort@WasmModuleObjectBuilderStreaming@v8@@QEAAXV?$MaybeLocal@VValue@v8@@@2@@Z-0x29d9d3 unitylibmanager+0x396764d @ 0x1430c764d
Cr_z_crc32+0x19dfb7 ?Abort@WasmModuleObjectBuilderStreaming@v8@@QEAAXV?$MaybeLocal@VValue@v8@@@2@@Z-0x29e1b9 unitylibmanager+0x3966e67 @ 0x1430c6e67
Cr_z_crc32+0x19dd01 ?Abort@WasmModuleObjectBuilderStreaming@v8@@QEAAXV?$MaybeLocal@VValue@v8@@@2@@Z-0x29e46f unitylibmanager+0x3966bb1 @ 0x1430c6bb1
?FatalException@node@@YAXPEAVIsolate@v8@@AEBVTryCatch@3@@Z+0x68109 uv_random-0x2cfc77 unitylibmanager+0x28a33c9 @ 0x1420033c9
?FatalException@node@@YAXPEAVIsolate@v8@@AEBVTryCatch@3@@Z+0x67ce8 uv_random-0x2d0098 unitylibmanager+0x28a2fa8 @ 0x142002fa8
uv_os_getpid+0x3791 Cr_z_adler32_z-0x484af unitylibmanager+0x16fa2e1 @ 0x140e5a2e1
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0000008
exception.offset: 42141
exception.address: 0x7fefdbfa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 131721872
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 131727072
registers.r11: 131723488
registers.r8: 0
registers.r9: 0
registers.rdx: 176
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1890040281
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x741e5000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000045f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2528
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
domain ipinfo.io
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\UnityLibManager.exe
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\libEGL.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\vk_swiftshader.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\nsis7z.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\vulkan-1.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\ffmpeg.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\libGLESv2.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\d3dcompiler_47.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\resources\elevate.exe
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\swiftshader\libGLESv2.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\StdUtils.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\swiftshader\libEGL.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\StdUtils.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\nsis7z.dll
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\resources\elevate.exe
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\System.dll
ESET-NOD32 JS/Agent.RFW
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2528
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x00000000bfff0000
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r:
flags: 5
oldfilepath_r: C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\UnityLibManager.exe
newfilepath:
oldfilepath: C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\UnityLibManager.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 0
family: 0
1 0 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\UnityLibManager.exe
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\chrome_200_percent.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\da.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\fr.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\hr.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\zh-TW.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\sw.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\th.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ru.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\resources\app.asar
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\es-419.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\pl.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\es.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\fi.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\te.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\lv.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\hi.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\tr.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\snapshot_blob.bin
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\he.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\resources.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\icudtl.dat
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\de.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\sv.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\en-GB.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\pt-PT.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\vi.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\bg.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\nl.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\bn.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ro.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ja.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\et.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\gu.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ms.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\fil.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ca.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\mr.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ta.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\cs.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\pt-BR.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\zh-CN.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\kn.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\fa.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\nb.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\lt.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\sr.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ml.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\hu.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\el.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\it.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\v8_context_snapshot.bin
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\lv.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\bn.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\vulkan-1.dll
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\th.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\hu.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\ffmpeg.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\es-419.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\zh-CN.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\ru.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\nl.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\pl.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\mr.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\sv.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\zh-CN.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\chrome_200_percent.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\gu.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\am.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\ml.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\te.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\pt-BR.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\gu.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\lv.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\fil.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ca.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\ffmpeg.dll
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\ms.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\th.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\hr.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\lt.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\fil.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\he.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\kn.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\snapshot_blob.bin
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\et.pak
file C:\Users\test22\AppData\Local\Temp\nsiCEC4.tmp
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\pt-PT.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\LICENSES.chromium.html
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\sl.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\vk_swiftshader_icd.json
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\bn.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\da.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\zh-TW.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\he.pak
file C:\Users\test22\AppData\Local\Temp\nsdCEF4.tmp\7z-out\locales\ms.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\pl.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\nl.pak
file C:\Users\test22\AppData\Local\Temp\2Yf8VIWz5LV2Xqj2X3PmhMry3FT\locales\en-GB.pak