Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 3, 2024, 11:04 a.m.	June 3, 2024, 11:06 a.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e9ac7172d4fe46c82cce7948a264f615`
SHA256	`36a196a29adaf0bf2353860f1e723f806975ee3d0b24a502c453510f1cfbfe3d`
CRC32	`CF51A5CE`
ssdeep	`24576:RYhVfvGHmYshVl6q4MTmNEQTeRbaFhqhsOzwQTN2K3yWds0JkKyVeo6tqymLoiH:mh9vqHsTRI5CRuFIzlIadsLCtvmL`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description)

kano.exe "C:\Users\test22\AppData\Local\Temp\kano.exe"
296
- schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
  2516
- schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
  2608

Name	Response	Post-Analysis Lookup
ipinfo.io	A 34.117.186.192	34.117.186.192
db-ip.com	A 104.26.5.15 A 104.26.4.15 A 172.67.75.166	104.26.4.15

IP Address	Status	Action
104.26.4.15	Active	Moloch
147.45.47.126	Active	Moloch
164.124.101.2	Active	Moloch
34.117.186.192	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 147.45.47.126:58709 -> 192.168.56.103:49165	2400022	ET DROP Spamhaus DROP Listed Traffic Inbound group 23	Misc Attack
TCP 192.168.56.103:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49166 -> 34.117.186.192:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49168 -> 104.26.4.15:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49165 -> 147.45.47.126:58709	2049060	ET MALWARE RisePro TCP Heartbeat Packet	A Network Trojan was detected
TCP 147.45.47.126:58709 -> 192.168.56.103:49165	2046266	ET MALWARE [ANY.RUN] RisePro TCP (Token)	A Network Trojan was detected
TCP 147.45.47.126:58709 -> 192.168.56.103:49165	2046267	ET MALWARE [ANY.RUN] RisePro TCP (External IP)	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 147.45.47.126:58709	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 147.45.47.126:58709	2049661	ET MALWARE RisePro CnC Activity (Inbound)	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 147.45.47.126:58709	2049661	ET MALWARE RisePro CnC Activity (Inbound)	A Network Trojan was detected
TCP 192.168.56.103:49166 -> 34.117.186.192:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49168 104.26.4.15:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=db-ip.com	1f:af:15:cd:f8:f8:ee:30:f9:6e:6e:54:bc:9a:a7:c7:77:70:6d:25

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameA June 3, 2024, 11:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 3, 2024, 11:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 3, 2024, 11:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 3, 2024, 11:05 a.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 3, 2024, 11:05 a.m.	buffer: SUCCESS: The scheduled task "MPGPH131 HR" has successfully been created. console_handle: 0x00000007	1	1	0
WriteConsoleW June 3, 2024, 11:05 a.m.	buffer: SUCCESS: The scheduled task "MPGPH131 LG" has successfully been created. console_handle: 0x00000007	1	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 3, 2024, 11:05 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section
section	.data\x00Th

One or more processes crashed (34 events)

Time & API	Arguments	Status
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6375 @ 0x376375 kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911944 registers.edi: 3592332 registers.eax: 0 registers.ebp: 8911972 registers.edx: 0 registers.ebx: 41825084 registers.esi: 5 registers.ecx: 41825084	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6375 @ 0x376375 kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911944 registers.edi: 8911944 registers.eax: 0 registers.ebp: 8911972 registers.edx: 0 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8912152	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6375 @ 0x376375 kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911944 registers.edi: 8911944 registers.eax: 0 registers.ebp: 8911972 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8912152	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e5ef5 @ 0x375ef5 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 3592332 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 4293029888 registers.esi: 2256896 registers.ecx: 2256896	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e5ef5 @ 0x375ef5 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e5fd1 @ 0x375fd1 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 3592332 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 4293029888 registers.esi: 2256896 registers.ecx: 0	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e5fd1 @ 0x375fd1 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e5fd1 @ 0x375fd1 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 3592332 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 4293029888 registers.esi: 2256896 registers.ecx: 8911924	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e60a3 @ 0x3760a3 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e619d @ 0x37619d kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 3592332 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 4293029888 registers.esi: 2256896 registers.ecx: 0	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e619d @ 0x37619d kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e619d @ 0x37619d kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e619d @ 0x37619d kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e619d @ 0x37619d kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e619d @ 0x37619d kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e619d @ 0x37619d kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6233 @ 0x376233 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 3592332 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 4293029888 registers.esi: 2256896 registers.ecx: 4294925493	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6233 @ 0x376233 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6233 @ 0x376233 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6233 @ 0x376233 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6233 @ 0x376233 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6233 @ 0x376233 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6233 @ 0x376233 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d204 exception.instruction: ud2 exception.module: kano.exe exception.exception_code: 0xc000001d exception.offset: 2413060 exception.address: 0x2dd204 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 2 registers.ebx: 3002863 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:04 a.m.	stacktrace: kano+0x2e6233 @ 0x376233 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: kano+0x24d1d9 exception.instruction: div eax exception.module: kano.exe exception.exception_code: 0xc0000094 exception.offset: 2413017 exception.address: 0x2dd1d9 registers.esp: 8911896 registers.edi: 8911896 registers.eax: 0 registers.ebp: 8911924 registers.edx: 0 registers.ebx: 3002906 registers.esi: 0 registers.ecx: 8911932	1
__exception__ June 3, 2024, 11:05 a.m.	stacktrace: RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7796f559 RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7796f639 RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7791df95 HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd kano+0x4b036 @ 0xdb036 kano+0x41cae @ 0xd1cae kano+0x338fe @ 0xc38fe kano+0x2e37 @ 0x92e37 kano+0x4665c @ 0xd665c kano+0x46454 @ 0xd6454 kano+0x46708 @ 0xd6708 kano+0x434da @ 0xd34da kano+0x43406 @ 0xd3406 kano+0x435c8 @ 0xd35c8 kano+0x4372f @ 0xd372f kano+0x33d64 @ 0xc3d64 0x87fc0c kano+0x2e6305 @ 0x376305 kano+0x2e1f6a @ 0x371f6a kano+0x2708dc @ 0x3008dc exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653 exception.instruction: jmp 0x7796e667 exception.module: ntdll.dll exception.exception_code: 0xc0000374 exception.offset: 845395 exception.address: 0x7796e653 registers.esp: 8911080 registers.edi: 12109528 registers.eax: 8911096 registers.ebp: 8911200 registers.edx: 0 registers.ebx: 0 registers.esi: 11927552 registers.ecx: 2147483647	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET https://db-ip.com/demo/home.php?s=175.208.134.152

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 2936832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02804000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02808000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02808000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 606208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02808000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02808000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02808000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 3, 2024, 11:04 a.m.	process_identifier: 296 region_size: 114688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02808000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (19 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW June 3, 2024, 11:05 a.m.	number_of_free_clusters: 8362495 sectors_per_cluster: 8362495 bytes_per_sector: 512 root_path: C: total_number_of_clusters: 8362495	1	1

Steals private information from local Internet browsers (50 out of 5998 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Sync Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Sync Extension Settings\eigblbgjknlfbajkfhopmcojidlgcehm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Sync Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opfgelmcmbiajamepnmloijbpoleiama\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Sync Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\fiikommddbeccaoicoejoniammnalkfa\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Sync Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Floc\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Sync Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Sync Extension Settings\chgfefjpcobfbnpmiokfjjaglahmnded\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\Sync Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local Extension Settings\eigblbgjknlfbajkfhopmcojidlgcehm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Sync Extension Settings\loinekcabhlmhjjbocijdoimmejangoa\CURRENT

Looks up the external IP address (1 event)

domain

ipinfo.io

Creates a suspicious process (2 events)

cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 3, 2024, 11:05 a.m.	thread_identifier: 2520 thread_handle: 0x00000160 process_identifier: 2516 current_directory: filepath: track: 1 command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000164	1	1	0
CreateProcessInternalW June 3, 2024, 11:05 a.m.	thread_identifier: 2612 thread_handle: 0x0000016c process_identifier: 2608 current_directory: filepath: track: 1 command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000168	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (38 events)

Time & API	Arguments	Status	Return
Process32FirstW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: [System Process] process_identifier: 0	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: System process_identifier: 4	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: smss.exe process_identifier: 232	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: services.exe process_identifier: 436	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: pw.exe process_identifier: 1944	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: taskhost.exe process_identifier: 1540	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: SearchProtocolHost.exe process_identifier: 1076	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: SearchFilterHost.exe process_identifier: 1000	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: kano.exe process_identifier: 296	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: svchost.exe process_identifier: 2300	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: mscorsvw.exe process_identifier: 2328	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: mscorsvw.exe process_identifier: 2368	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: sppsvc.exe process_identifier: 2420	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: cmd.exe process_identifier: 2500	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: conhost.exe process_identifier: 2508	1	1
Process32NextW June 3, 2024, 11:05 a.m.	snapshot_handle: 0x00000494 process_name: pw.exe process_identifier: 2552	1	1

The binary likely contains encrypted or compressed data indicative of a packer (6 events)

section

{u'size_of_data': u'0x00093c00', u'virtual_address': u'0x00001000', u'entropy': 7.999618063398345, u'name': u'', u'virtual_size': u'0x0015c000'}

entropy

7.9996180634

description