Summary | ZeroBOX

random.exe

Client SW User Data Stealer RedLine stealer info stealer Amadey EnigmaProtector Generic Malware browser Google UPX Chrome User Data Downloader Malicious Library Malicious Packer Escalate priviledges ScreenShot Socket Http API Create Service DGA
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 1, 2024, 10:53 a.m. Aug. 1, 2024, 11:02 a.m.
Size 1.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 28700cd817abafa9a16ad89a0f7ffd86
SHA256 b6006ca93e5115af8f849d8c9dcba4b1cc6487717d40d6de2bb0cdb795fb6c15
CRC32 7649ADF7
ssdeep 49152:eSUlFq68xolhV4Oq2N8V3Gszu01WM2rlXLWuBrB:eZ4Oq26AW1WM2rlbWIN
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

IP Address Status Action
164.124.101.2 Active Moloch
185.215.113.16 Active Moloch
185.215.113.19 Active Moloch
34.49.45.138 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 185.215.113.16:80 -> 192.168.56.101:49166 2400032 ET DROP Spamhaus DROP Listed Traffic Inbound group 33 Misc Attack
TCP 185.215.113.19:80 -> 192.168.56.101:49165 2400032 ET DROP Spamhaus DROP Listed Traffic Inbound group 33 Misc Attack
TCP 192.168.56.101:49166 -> 185.215.113.16:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.215.113.16:80 -> 192.168.56.101:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.215.113.16:80 -> 192.168.56.101:49166 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.215.113.16:80 -> 192.168.56.101:49166 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 185.215.113.19:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.101:49174 -> 185.215.113.16:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.215.113.16:80 -> 192.168.56.101:49174 2014819 ET INFO Packed Executable Download Misc activity
TCP 185.215.113.16:80 -> 192.168.56.101:49174 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.215.113.16:80 -> 192.168.56.101:49174 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.215.113.16:80 -> 192.168.56.101:49174 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 185.215.113.19:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.101:49171 -> 185.215.113.19:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.101:49231 -> 34.49.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49233 -> 34.49.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49234 -> 34.49.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.215.113.16:80 -> 192.168.56.101:49174 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.101:49174 -> 185.215.113.16:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.101:49230 -> 34.49.45.138:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
file C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Locales\ko.pak
file C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
section \x00
section .idata
section
section odfdqouh
section ubeqwywd
section .taggant
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc
exception.symbol: random+0x3210b9
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 3281081
exception.address: 0xb810b9
registers.esp: 4128572
registers.edi: 0
registers.eax: 1
registers.ebp: 4128588
registers.edx: 13807616
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 42 11 db 2c 89 04 24 e9 6b 02 00 00 53 e9
exception.symbol: random+0x6d0a5
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 446629
exception.address: 0x8cd0a5
registers.esp: 4128540
registers.edi: 242921
registers.eax: 9259196
registers.ebp: 3999248404
registers.edx: 4294938352
registers.ebx: 9175074
registers.esi: 3
registers.ecx: 1969094656
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 4c 53 f5 3d 89 1c 24 89 14 24 89 1c 24 e9
exception.symbol: random+0x6e3ec
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 451564
exception.address: 0x8ce3ec
registers.esp: 4128536
registers.edi: 242921
registers.eax: 9231531
registers.ebp: 3999248404
registers.edx: 4294938352
registers.ebx: 25983921
registers.esi: 3
registers.ecx: 1969094656
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 51 68 c2 4a 48 10 89 14 24 ba 91 2e 14 53 89
exception.symbol: random+0x6e1fd
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 451069
exception.address: 0x8ce1fd
registers.esp: 4128540
registers.edi: 1259
registers.eax: 9234657
registers.ebp: 3999248404
registers.edx: 4294938352
registers.ebx: 25983921
registers.esi: 0
registers.ecx: 1969094656
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 c3 73 ca 4d 1f 68 20 44 2a 70 89 04 24 e9
exception.symbol: random+0x1ecf44
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2019140
exception.address: 0xa4cf44
registers.esp: 4128536
registers.edi: 9267594
registers.eax: 32440
registers.ebp: 3999248404
registers.edx: 2130566132
registers.ebx: 10798502
registers.esi: 10781459
registers.ecx: 718
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 89 2c 24 53 c7 04 24 1b d6 ea 11 89 2c 24
exception.symbol: random+0x1ed077
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2019447
exception.address: 0xa4d077
registers.esp: 4128540
registers.edi: 9267594
registers.eax: 32440
registers.ebp: 3999248404
registers.edx: 2130566132
registers.ebx: 10830942
registers.esi: 10781459
registers.ecx: 718
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 56 89 0c 24 57 c7 04 24 93 ca fb 73 81 24 24
exception.symbol: random+0x1ece76
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2018934
exception.address: 0xa4ce76
registers.esp: 4128540
registers.edi: 100841
registers.eax: 4294938020
registers.ebp: 3999248404
registers.edx: 2130566132
registers.ebx: 10830942
registers.esi: 10781459
registers.ecx: 718
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 50 56 68 1b a9 b6 2b e9 33 f8 ff ff ba 04 00
exception.symbol: random+0x1ee863
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2025571
exception.address: 0xa4e863
registers.esp: 4128540
registers.edi: 10808264
registers.eax: 30307
registers.ebp: 3999248404
registers.edx: 2130566132
registers.ebx: 50665
registers.esi: 0
registers.ecx: 718
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 c6 92 e1 17 2d e9 4a f9 ff ff 38 c3 87 50
exception.symbol: random+0x1f079c
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2033564
exception.address: 0xa5079c
registers.esp: 4128536
registers.edi: 10803588
registers.eax: 26354
registers.ebp: 3999248404
registers.edx: 55684
registers.ebx: 10810253
registers.esi: 10812670
registers.ecx: 1670757413
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 e8 9e a2 6f 89 04 24 c7 04 24 0a 64 da 7d
exception.symbol: random+0x1f0498
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2032792
exception.address: 0xa50498
registers.esp: 4128540
registers.edi: 10803588
registers.eax: 202985
registers.ebp: 3999248404
registers.edx: 4294943668
registers.ebx: 10810253
registers.esi: 10839024
registers.ecx: 1670757413
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 64 8f 05 00 00 00 00 52 81 ec 04 00 00 00 89
exception.symbol: random+0x1fa259
exception.instruction: in eax, dx
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2073177
exception.address: 0xa5a259
registers.esp: 4128532
registers.edi: 4992536
registers.eax: 1447909480
registers.ebp: 3999248404
registers.edx: 22104
registers.ebx: 1969033397
registers.esi: 10844652
registers.ecx: 20
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb
exception.symbol: random+0x1fd00d
exception.address: 0xa5d00d
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 2084877
registers.esp: 4128532
registers.edi: 4992536
registers.eax: 1
registers.ebp: 3999248404
registers.edx: 22104
registers.ebx: 0
registers.esi: 10844652
registers.ecx: 20
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 19 2b 2d 12 01
exception.symbol: random+0x1fb151
exception.instruction: in eax, dx
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2077009
exception.address: 0xa5b151
registers.esp: 4128532
registers.edi: 4992536
registers.eax: 1447909480
registers.ebp: 3999248404
registers.edx: 22104
registers.ebx: 2256917605
registers.esi: 10844652
registers.ecx: 10
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: cd 01 eb 00 6a 00 55 e8 03 00 00 00 20 5d c3 5d
exception.symbol: random+0x2004f1
exception.instruction: int 1
exception.module: random.exe
exception.exception_code: 0xc0000005
exception.offset: 2098417
exception.address: 0xa604f1
registers.esp: 4128500
registers.edi: 0
registers.eax: 4128500
registers.ebp: 3999248404
registers.edx: 10880202
registers.ebx: 10880647
registers.esi: 0
registers.ecx: 2124437135
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 55 5f 2c 1f e9 48 01 00 00 89 04 24 53 bb
exception.symbol: random+0x2009d1
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2099665
exception.address: 0xa609d1
registers.esp: 4128536
registers.edi: 10881302
registers.eax: 32508
registers.ebp: 3999248404
registers.edx: 2130566132
registers.ebx: 26461577
registers.esi: 10
registers.ecx: 4992536
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 31 d2 e9 9b f6 ff ff 81 44 24 04 47 b4 ac 7f
exception.symbol: random+0x201491
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2102417
exception.address: 0xa61491
registers.esp: 4128540
registers.edi: 10913810
registers.eax: 32508
registers.ebp: 3999248404
registers.edx: 2130566132
registers.ebx: 26461577
registers.esi: 10
registers.ecx: 4992536
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 ec 04 00 00 00 89 3c 24 c7 04 24 cf ad 32
exception.symbol: random+0x20144f
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2102351
exception.address: 0xa6144f
registers.esp: 4128540
registers.edi: 10913810
registers.eax: 2283
registers.ebp: 3999248404
registers.edx: 4294938052
registers.ebx: 26461577
registers.esi: 10
registers.ecx: 4992536
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 51 68 6c 3d fd 3b ff 34 24 e9 f4 00 00 00 29
exception.symbol: random+0x210407
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2163719
exception.address: 0xa70407
registers.esp: 4128540
registers.edi: 23390544
registers.eax: 4294937428
registers.ebp: 3999248404
registers.edx: 6
registers.ebx: 26461799
registers.esi: 10976263
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 52 54 5a 81 c2 04 00 00 00 52 89 3c 24 bf 04
exception.symbol: random+0x214d77
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2182519
exception.address: 0xa74d77
registers.esp: 4128532
registers.edi: 23390544
registers.eax: 30935
registers.ebp: 3999248404
registers.edx: 936491602
registers.ebx: 10992707
registers.esi: 4294939336
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 6a 06 00 00 89 1c 24 e9 e3 03 00 00 b8 9d
exception.symbol: random+0x2150fa
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2183418
exception.address: 0xa750fa
registers.esp: 4128532
registers.edi: 4294944156
registers.eax: 25847
registers.ebp: 3999248404
registers.edx: 10991046
registers.ebx: 2069077696
registers.esi: 4294939336
registers.ecx: 1179202795
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 ee 00 00 00 be 30 7d 10 ea e9 0e fe ff ff
exception.symbol: random+0x21c904
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2214148
exception.address: 0xa7c904
registers.esp: 4128532
registers.edi: 11020387
registers.eax: 25723
registers.ebp: 3999248404
registers.edx: 4294944084
registers.ebx: 4628
registers.esi: 84201
registers.ecx: 2118254592
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 56 e9 4d fb ff ff 52 ba 7a 43 ff 6c 21 d3 5a
exception.symbol: random+0x22b917
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2275607
exception.address: 0xa8b917
registers.esp: 4128528
registers.edi: 2298892471
registers.eax: 11054483
registers.ebp: 3999248404
registers.edx: 0
registers.ebx: 2309938679
registers.esi: 2309938512
registers.ecx: 159551412
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 e9 40 00 00 00 81 c9 70 da 83 3b e9 08 02
exception.symbol: random+0x22b52c
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2274604
exception.address: 0xa8b52c
registers.esp: 4128532
registers.edi: 2298892471
registers.eax: 11080368
registers.ebp: 3999248404
registers.edx: 0
registers.ebx: 2309938679
registers.esi: 2309938512
registers.ecx: 159551412
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 f3 00 00 00 8f 04 10 68 ce 23 62 47 89 1c
exception.symbol: random+0x22b5bc
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2274748
exception.address: 0xa8b5bc
registers.esp: 4128532
registers.edi: 2298892471
registers.eax: 11080368
registers.ebp: 3999248404
registers.edx: 4294944640
registers.ebx: 116969
registers.esi: 2309938512
registers.ecx: 159551412
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 83 ec 04 89 0c 24 68 01 fc bb 77 8b 0c 24 83
exception.symbol: random+0x23d86d
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2349165
exception.address: 0xa9d86d
registers.esp: 4128500
registers.edi: 9237815
registers.eax: 0
registers.ebp: 3999248404
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 3633079904
registers.ecx: 11131344
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 89 34 24 52 ba 4c 89 ff 4b 52 5e 8b 14 24
exception.symbol: random+0x23edd0
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2354640
exception.address: 0xa9edd0
registers.esp: 4128496
registers.edi: 11132105
registers.eax: 31284
registers.ebp: 3999248404
registers.edx: 1318271071
registers.ebx: 11134207
registers.esi: 11131373
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 bb 3d 8f d9 4b e9 cf 03 00 00 ff 74 24 04
exception.symbol: random+0x23e696
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2352790
exception.address: 0xa9e696
registers.esp: 4128500
registers.edi: 11132105
registers.eax: 31284
registers.ebp: 3999248404
registers.edx: 1318271071
registers.ebx: 11165491
registers.esi: 11131373
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 21 00 00 00 81 c2 88 8b dd 6f 57 bf d6 86
exception.symbol: random+0x23f164
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2355556
exception.address: 0xa9f164
registers.esp: 4128500
registers.edi: 11132105
registers.eax: 31284
registers.ebp: 3999248404
registers.edx: 3860007864
registers.ebx: 11165491
registers.esi: 4294939268
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 ec 04 00 00 00 89 1c 24 bb 89 99 bb 7f 29
exception.symbol: random+0x23fa9b
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2357915
exception.address: 0xa9fa9b
registers.esp: 4128496
registers.edi: 11132105
registers.eax: 32732
registers.ebp: 3999248404
registers.edx: 189904121
registers.ebx: 25804023
registers.esi: 11137832
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 ec 04 00 00 00 e9 00 00 00 00 89 14 24 89
exception.symbol: random+0x240117
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2359575
exception.address: 0xaa0117
registers.esp: 4128500
registers.edi: 11132105
registers.eax: 32732
registers.ebp: 3999248404
registers.edx: 189904121
registers.ebx: 25804023
registers.esi: 11170564
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb b9 42 63 43 3b 68 68 4a 6c 1f e9 0b 00 00 00
exception.symbol: random+0x240025
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2359333
exception.address: 0xaa0025
registers.esp: 4128500
registers.edi: 0
registers.eax: 32732
registers.ebp: 3999248404
registers.edx: 189904121
registers.ebx: 25804023
registers.esi: 11141432
registers.ecx: 605849942
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 66 06 00 00 56 89 1c 24 bb b8 40 37 7f e9
exception.symbol: random+0x243f87
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2375559
exception.address: 0xaa3f87
registers.esp: 4128500
registers.edi: 0
registers.eax: 31861
registers.ebp: 3999248404
registers.edx: 0
registers.ebx: 9231141
registers.esi: 11188976
registers.ecx: 1971716238
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 b1 09 00 00 5d 83 e8 04 87 04 24 5c 89 0c
exception.symbol: random+0x243f9b
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2375579
exception.address: 0xaa3f9b
registers.esp: 4128500
registers.edi: 0
registers.eax: 0
registers.ebp: 3999248404
registers.edx: 44777
registers.ebx: 9231141
registers.esi: 11160284
registers.ecx: 1971716238
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 00 b1 14 6f 89 3c 24 51 56 c7 04 24 99 50
exception.symbol: random+0x246a35
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2386485
exception.address: 0xaa6a35
registers.esp: 4128496
registers.edi: 0
registers.eax: 30421
registers.ebp: 3999248404
registers.edx: 601243567
registers.ebx: 9231141
registers.esi: 11160284
registers.ecx: 11168254
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 c7 04 24 88 ff fd 5f 52 ba ea c7 a5 7d 4a
exception.symbol: random+0x247168
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2388328
exception.address: 0xaa7168
registers.esp: 4128500
registers.edi: 0
registers.eax: 30421
registers.ebp: 3999248404
registers.edx: 601243567
registers.ebx: 9231141
registers.esi: 11160284
registers.ecx: 11198675
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 e9 c5 fa ff ff 31 fa e9 4a 01 00 00 01 eb
exception.symbol: random+0x247123
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2388259
exception.address: 0xaa7123
registers.esp: 4128500
registers.edi: 0
registers.eax: 0
registers.ebp: 3999248404
registers.edx: 2298801283
registers.ebx: 9231141
registers.esi: 11160284
registers.ecx: 11171227
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 83 ec 04 e9 51 02 00 00 68 eb b3 fc 5b 59 81
exception.symbol: random+0x24b9d7
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2406871
exception.address: 0xaab9d7
registers.esp: 4128500
registers.edi: 4009044218
registers.eax: 31304
registers.ebp: 3999248404
registers.edx: 1649410169
registers.ebx: 4009732863
registers.esi: 11217934
registers.ecx: 1660594880
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 89 34 24 51 e9 28 03 00 00 c7 04 24 d4 84
exception.symbol: random+0x24b419
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2405401
exception.address: 0xaab419
registers.esp: 4128500
registers.edi: 0
registers.eax: 607947088
registers.ebp: 3999248404
registers.edx: 1649410169
registers.ebx: 4009732863
registers.esi: 11189414
registers.ecx: 1660594880
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 31 ff e9 a8 06 00 00 5e 51 b9 1a 9a ff c8 e9
exception.symbol: random+0x24bff7
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2408439
exception.address: 0xaabff7
registers.esp: 4128500
registers.edi: 0
registers.eax: 27664
registers.ebp: 3999248404
registers.edx: 1811674038
registers.ebx: 4009732863
registers.esi: 11189414
registers.ecx: 11217562
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 89 e7 81 c7 04 00 00 00 83 ef 04 87 3c 24
exception.symbol: random+0x24c8ac
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2410668
exception.address: 0xaac8ac
registers.esp: 4128500
registers.edi: 4294942460
registers.eax: 27664
registers.ebp: 3999248404
registers.edx: 1811674038
registers.ebx: 4009732863
registers.esi: 606898515
registers.ecx: 11217562
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 81 ec 04 00 00 00 89 14 24 e9 68 f9 ff ff
exception.symbol: random+0x257931
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2455857
exception.address: 0xab7931
registers.esp: 4128500
registers.edi: 11214510
registers.eax: 3580761704
registers.ebp: 3999248404
registers.edx: 4294938192
registers.ebx: 11267383
registers.esi: 11194280
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 83 ec 04 89 14 24 89 e2 81 c2 04 00 00 00 e9
exception.symbol: random+0x2674fe
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2520318
exception.address: 0xac74fe
registers.esp: 4128500
registers.edi: 2134485324
registers.eax: 27511
registers.ebp: 3999248404
registers.edx: 11327105
registers.ebx: 11282432
registers.esi: 4440328
registers.ecx: 2118278079
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 51 e9 11 05 00 00 8b 14 24 81 c4 04 00 00 00
exception.symbol: random+0x266f61
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2518881
exception.address: 0xac6f61
registers.esp: 4128500
registers.edi: 2134485324
registers.eax: 27511
registers.ebp: 3999248404
registers.edx: 11302485
registers.ebx: 11282432
registers.esi: 0
registers.ecx: 606898512
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 e9 d1 f8 ff ff 58 50 b8 c8 43 8f 6f 25 b1
exception.symbol: random+0x270271
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2556529
exception.address: 0xad0271
registers.esp: 4128496
registers.edi: 11315576
registers.eax: 28324
registers.ebp: 3999248404
registers.edx: 1565064
registers.ebx: 11336499
registers.esi: 0
registers.ecx: 2118254592
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 89 e7 81 c7 04 00 00 00 81 ef 04 00 00 00
exception.symbol: random+0x26fd9f
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2555295
exception.address: 0xacfd9f
registers.esp: 4128500
registers.edi: 11315576
registers.eax: 28324
registers.ebp: 3999248404
registers.edx: 1565064
registers.ebx: 11364823
registers.esi: 0
registers.ecx: 2118254592
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 bb 17 3d f8 5e 50 52 68 e0 a8 af 6d e9 99
exception.symbol: random+0x270295
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2556565
exception.address: 0xad0295
registers.esp: 4128500
registers.edi: 604292947
registers.eax: 28324
registers.ebp: 3999248404
registers.edx: 1565064
registers.ebx: 11339915
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 39 fb ff ff 89 3c 24 68 14 2e 54 5a 89 1c
exception.symbol: random+0x27f3a3
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2618275
exception.address: 0xadf3a3
registers.esp: 4128500
registers.edi: 2134485324
registers.eax: 32798
registers.ebp: 3999248404
registers.edx: 108
registers.ebx: 1118875237
registers.esi: 3964645431
registers.ecx: 11431090
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 56 68 80 88 de 7b e9 0e f9 ff ff 4f c1 ef 04
exception.symbol: random+0x27f71e
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2619166
exception.address: 0xadf71e
registers.esp: 4128500
registers.edi: 2134485324
registers.eax: 0
registers.ebp: 3999248404
registers.edx: 108
registers.ebx: 604277079
registers.esi: 3964645431
registers.ecx: 11401706
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 19 32 91 17 89 04 24 b8 c1 cf d3 09 56 68
exception.symbol: random+0x2872f6
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2650870
exception.address: 0xae72f6
registers.esp: 4128500
registers.edi: 2134485324
registers.eax: 0
registers.ebp: 3999248404
registers.edx: 11
registers.ebx: 2170508375
registers.esi: 11435425
registers.ecx: 12
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 89 14 24 51 b9 00 cb ff 37 81 f1 23 7c 76
exception.symbol: random+0x29dd8a
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2743690
exception.address: 0xafdd8a
registers.esp: 4128496
registers.edi: 11156670
registers.eax: 11523402
registers.ebp: 3999248404
registers.edx: 395049983
registers.ebx: 16910336
registers.esi: 11156667
registers.ecx: 3738837507
1 0 0
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.215.113.19/Vi9leo/index.php
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.215.113.16/cost/random.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.215.113.16/steam/random.exe
request POST http://185.215.113.19/Vi9leo/index.php
request GET http://185.215.113.16/cost/random.exe
request GET http://185.215.113.16/steam/random.exe
request POST http://185.215.113.19/Vi9leo/index.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76faf000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76f20000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 188416
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00861000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00760000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00830000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00840000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02490000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02500000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02510000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02520000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02730000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02740000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02750000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02860000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02aa0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02be0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73402000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03100000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003f20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76faf000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76f20000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2820
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 188416
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b61000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02670000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02680000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02690000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2820
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02820000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description explorti.exe tried to sleep 1128 seconds, actually delayed analysis time by 1128 seconds
Application Crash Process chrome.exe with pid 2104 crashed
Application Crash Process firefox.exe with pid 2560 crashed
Application Crash Process firefox.exe with pid 2176 crashed
Application Crash Process firefox.exe with pid 3144 crashed
Time & API Arguments Status Return Repeated

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 186510672
registers.r15: 186511112
registers.rcx: 1304
registers.rsi: 17302540
registers.r10: 0
registers.rbx: 53951520
registers.rsp: 186509832
registers.r11: 186514368
registers.r8: 1994752396
registers.r9: 0
registers.rdx: 1540
registers.r12: 32421440
registers.rbp: 186509984
registers.rdi: 32355616
registers.rax: 7548416
registers.r13: 186510544
1 0 0

__exception__

stacktrace:
0xcd1f04
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030

exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 07
exception.instruction: cmp dword ptr [rip + 0x2d18d], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xcd1f04
registers.r14: 10613624
registers.r15: 8791502591600
registers.rcx: 48
registers.rsi: 8791502523264
registers.r10: 0
registers.rbx: 0
registers.rsp: 10613256
registers.r11: 10616640
registers.r8: 1994752396
registers.r9: 0
registers.rdx: 8796092887632
registers.r12: 14920416
registers.rbp: 10613376
registers.rdi: 68264928
registers.rax: 13442816
registers.r13: 10614216
1 0 0

__exception__

stacktrace:
0xcd1f04
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030
0x7fe00000030

exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 07
exception.instruction: cmp dword ptr [rip + 0x2d18d], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xcd1f04
registers.r14: 9957880
registers.r15: 8791381350000
registers.rcx: 48
registers.rsi: 8791381281664
registers.r10: 0
registers.rbx: 0
registers.rsp: 9957512
registers.r11: 9960896
registers.r8: 1994752396
registers.r9: 0
registers.rdx: 8796092883536
registers.r12: 14909104
registers.rbp: 9957632
registers.rdi: 68263968
registers.rax: 13442816
registers.r13: 9958472
1 0 0

__exception__

stacktrace:
0xcd1f04
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30
0x30

exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 07
exception.instruction: cmp dword ptr [rip + 0x2d18d], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0xcd1f04
registers.r14: 9959904
registers.r15: 9959408
registers.rcx: 48
registers.rsi: 14706144
registers.r10: 0
registers.rbx: 0
registers.rsp: 9958456
registers.r11: 9960656
registers.r8: 1994752396
registers.r9: 0
registers.rdx: 8796092887632
registers.r12: 9959239
registers.rbp: 9958576
registers.rdi: 100
registers.rax: 13442816
registers.r13: 2
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Csd Whitelist
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom Prefix Set
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing IP Blacklist
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Module Whitelist
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\ChromeFilenameClientIncident.store
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Side-Effect Free Whitelist
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List Prefix Set
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Inclusion Whitelist
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\1bc89aeb-5015-48df-b6df-e5afa4d6e0a9.dmp
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-active.pma
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Extension Blacklist
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-63327DF3-A54.pma
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Resource Blacklist
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-66AB1E41-838.pma
file C:\Users\test22\AppData\Local\Google\Chrome\User Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download Whitelist
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Download
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Stability\2104-1722477224802734.pma
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\AnyIpMalware.store
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing UwS List
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Bloom
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3
file C:\Users\test22\1000029002\8e92683325.exe
file C:\Users\test22\AppData\Local\Temp\191.tmp\192.tmp\193.bat
file C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe
cmdline "C:\Windows\sysnative\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\191.tmp\192.tmp\193.bat C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe"
file C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
file C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe
file C:\Users\test22\1000029002\8e92683325.exe
file C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe
file C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\1000029002\8e92683325.exe
parameters:
filepath: C:\Users\test22\1000029002\8e92683325.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Windows\sysnative\cmd
parameters: /c "C:\Users\test22\AppData\Local\Temp\191.tmp\192.tmp\193.bat C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe"
filepath: C:\Windows\sysnative\cmd
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000001ebe4200000
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

InternetReadFile

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELb@]à 2 V0@ |qȐœpt,.codeð78 `.textÂÒPÔ< `.rdata304@@.data,pD@À.rsrcœV@@h¬hh€Aè\@ƒÄ hèU@£€AhhhèB@£€Aè¼?¸ˆpA£4€AèÝÍèIËèCšèǒèZèԊèø…èx}è@Cèöèk¡º.pA €AèÓ?hõÿÿÿèã?£<€A¸P¸€AP1ÀPhhèÿ5 €Aè “hhxpA €APhè_’ÿ5¨€Aèæ’hhppA¨€APhè9’h˜€Ah€pAhh¡†h èÊº:pA l€Aè+?ÿ5°€A蒒hhppA°€APhè呍;@PèÁ‡Rè ÍZPèÅhH€Aè:Íè ‹X€AƒûuèfèS,hèè±Ìÿ5€AèÎ>èÏ>èµA臇èç”轘èìÀèS‰ÃUSWºƒìÇ$Juó‹T$X $èa>ÿ4$èùD‰D$ÿt$èL‰‰D$T$ Rhhhhè”ɍT$RhhhhèvÉÇD$ÇD$ ÇD$$ÇD$(ÇD$,ÇD$0ÇD$ ÇD$ ÿt$ X‰D$4ÿt$X‰D$8ÇD$ë¸ÿ;D$|Tÿt$‹l$8X‰E‹\$4ƒÃ‰\$4‹l$8¾]!Ûu ÿt$X‰D$8‹l$8¾EP‹\$ ‹l$ÁãX‰D‹\$8C‰\$8ÿD$q¡ÇD$ ÇD$ë¸ÿ;D$|m‹\$ ‹|$‹l$ Áç\=‹|$‹l$Áç\=ãÿ‰\$ ‹\$‹l$ ÁãÿtX‰D$,‹\$ Áãÿt‹\$ ÁãX‰Dÿt$,‹\$$ÁãX‰DÿD$qˆÇD$ÇD$ ÿt$PX‰D$<ÇD$(ë‹\$TK;\$(ŒÃ‹\$Cãÿ‰\$‹\$ ‹|$‹l$ Áç\=ãÿ‰\$ ‹\$ÁãÿtX‰D$,‹\$ Áãÿt‹\$ ÁãX‰Dÿt$,‹\$$ÁãX‰D‹\$Áã‹\‹|$ Áç‹|=çÿûãÿ‰\$$‹\$$ÁãÿtX‰D$0‹l$<¾]3\$0S‹l$@XˆE‹\$<C‰\$<ÿD$(.ÿÿÿT$ RhhhhèǍT$RhhhhèÇÿt$譆‹D$Pë1Àÿ4$èmÊPÿt$è0Èÿt$è'ÈXƒÄ@_[] USº ƒìÇ$Juóè§Ê‹”€Aƒû…2‹|€Aƒûu‹h€Aƒût¸ë1À!À„¸&pAPÿ5€AèB‰$ÇD$ë‹$;D$Œ’RèÉZPRèøÈZP¸fpAPÿt$ÿ5€AèQBD$ PèÉÿt$èé!ÀtLRèÄÈZPÿt$ è3D$PèïȋT$Rè¥ÈZPRè=ʋT$Rè3ʺfpARè(ʍD$Pè¾ÈÿD$aÿÿÿÿt$èë@‰D$hD$Pÿt$è4…Pÿt$ ÿ5<€AèX:ÿt$è;…º$pA €Aè:éÎÇ”€AÇD$RèÈZPRèÈZP¸.pAPÿt$(ÿ5$€Aè_AD$Pè%ȸ2pAPÿt$èC‰D$ ƒ|$ t\RèÅÇZPRè½ÇZP¸2pAPhÿt$ èAD$(PèÝÇRè—ÇZPRèÇZP¸2pAPhÿt$ èé@D$Pè¯Ç‹T$1Éè:…î‹\$‰Ø¹™÷ù‰Ó!Ûu+ÿt$è¡BP‹\$‹-˜€AkÛ ÝX‰E‹\$C‰\$é­RèÇZPRèÇZPhÿt$è¡CèüȺ6pAYQèÐ9‰Áè‰9„´‹P€ARè×ÆZPRèoȋl€ARècÈRè½ÆZPRèµÆZP¸6pAPÿt$ èÄEXD$,PèÙÆÿt$(èՎ‹„€Aƒûuÿt$$èÜAPÿt$,è7ÿt$(è'$‹€ARè]ÆZPRèõNjT$,RèëǺfpARèàǍ€APètÆé½Rè)ÆZPRè!ÆZP¸6pAPÿt$è0ED$PèFƋT$RèüÅZPRè”Ç‹\$‹-˜€AkÛ ݍEPèÆÿt$$è3AP‹\$‹-˜€AkÛ ÝX‰E‹€ARè³ÅZPRèKNjP€ARè?Njl€ARè3NjT$Rè)ǺfpARèǍ€APè²Åëë‹\$C‰\$éLýÿÿ‹D$ë1Àÿt$èÆÿt$(èÆÿt$è Æÿt$$èÆÿt$ èûŃÄ,[]ÃS1ÀPPPPPPèWƸ qA£4€AÇ$ë¸;$|d¡4€A¾‰D$ÿ4€ARèâÄZPRèÚÄZP‹\$ kÛÿSè DD$ PèŋT$ Rè·ÄZPRèOƋT$ RèEƍD$PèÛÄÿ$q’h謁‰D$Rè‚ÄZPRèzÄZPèID$Pè©Äÿt$h¸$pAPÿt$ èk6RèKÄZPRèCÄZPÿt$èxx€APèlÄÿ5x€A舍ÿ5x€Aè[Œÿt$h¸$pAPÿ5x€Aè6RèöÃZPRèîÃZPÿt$è#,€APèÄÿ5,€Aè3ÿ5,€AèŒÿt$h¸$pAPÿ5,€AèÁ5ÿ5,€Aèw8Rè–ÃZPRèŽÃZPÿt$èÀ@€APè·Ãÿ5@€Aèӌÿt$ ÿ5@€Aè>8ÿt$h¸$pAPÿ5,€Aè]5Rè=ÃZPRè5ÃZPÿt$èj€p€APè^Ãÿt$è€ë1Àÿt$èØÃÿt$èÏÃÿt$ èÆÃÄ[ÃUS1ÀPPPPPPè"ÄRèÜÂZPhhRèÊÂZPRèÂÂZPèÓzè¸5$èÎ4èÉ5‰$h !@Pÿt$è·4ÿ4$èµ4ÿ5°€AèAˆ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $„_´Vå1çVå1çVå1ç9“šçOå1ç9“¯çwå1ç9“›ç+å1ç_¢ç]å1çVå0ç*å1ç9“žçWå1ç9“«çWå1ç9“¬çWå1çRichVå1çPEL kö¹eà  j˜@|*Þ€@@Þ¶þ€ ½B D½àBÔ|p2@à@€6@à@?ÀF@àBN@àBN@àÀ B N@à.rsrc€àB~X@@€y`C(Ö@à.data`!à¼`!þ@àÁpävõlýµÊ̕Z!Õ[‚õAi̓Ñ驨n#2ý»ÛûNJPë $û^¡TÁšd„oϵLŠÅmyôe:Äü?.R+CL4¸„C`ôGìfâè²ÊPÌƄ­† v Ìg¯yh!€Jsµ»!˜{¾¬©ä[ú-¼ÄŠí»¦?jséf€£-Òuj‘\I×ÿˆÄ”[µ±v§œZFԁ1È=¦¤°+wYÂhtnâEmZ« ·rܘy• ¡‡ãøÄöΉ,3ÝEÇ#û‘ž( Š¿Ê*þ6mJ&J›§œK–æ*ï›Ê\i\”f¡)<>^Y“y'H%³µrS÷‚ñ@G›î¨ÊÐ¥n*BÆ´­‚†óNh°‘jÎ@ÈMÁÙç4™å,8ù F‚køÈIóâx±k’ÚR¿ž€¦ ×<—Óx¾>ªŠTŠ€^N¢N7G;«ªýß Ù<•'^"›^7´”}í<•¾Ö‘&¨çIö•[†SîZµ1£èsIåÌÝë©lØ<a‹y±_á÷p¬¤'úÍz1±ÐöÀž¡Ö7ëNF p~Dcƒi\+Ûj+&Qy¬ŸÃzKÏ<;ûãÃ6뮢Ö®uÇ®N\Æœ‹Jö^lów=õL7ªååü³qÆ0&¦Òj£]t[yc‹™Ë¤Ýúp¨@†Ä[úäuŽ*7›TD„ö1i—íšGW³>=}žºyx:9„~%l­ôèÎÖ)÷Mïüؼ$cóNTèbžø©kÂ7>Äpů€ËÖù,ÓtèËTꙏ;C¤9 ¸ïo'p¥çΨ5Ê÷Ð×±ºµ¨2Ûz‰™`\3ý÷ ˜Ž`¯¦ƒ™5Ÿ÷óŽd¯“ÚE÷ZæEwÁG7ngg_*ëUû݃ V‘Aš§± 5³ƒFŠWºÁÚéß¿§¥rÔJeLê­Fºj²‹ëÀk»§]\7¥âƒO!¼Ñ÷©ýzÅšêPàï]d1óJ¦®›ÏÁÀNè£+¯ þ´ñ¸GSnöøìœèÆFß ±gÉé'ØÔ±%”È1®mô¨@U§ž Á=¸òè"£ cŸ »¾;PѺñ  #7µe\ÑÆ×ý!û63­:zþ¦Fïx¥”¼ƒ5à­öˆÀŸP™‘ÙüÛG ãl’ˆì´²—!VÔ³—z«Ì›Wœæ{•ÄÛm½ÝO½/êØàŠÃU댔°[’LRaÍ€†SŽ‡ž\•„±ã¦XÒqô ¾ŸO*v{o­bý1Ñbï÷<¤Ë^ʧdçàß6jÇ«Z6¤Œ‰‚éïkែֶôÚ¥l{^*È¿¿ì*¯V=úR]H:@½švú ˜vºñSñÀtµ»+ß& zâF­ðü‡MNŽðÙ ¥Êӑ}ç³tp(«‰7Ñkâ¬<C_Fuâ…òòŽnql›4Ÿçé?/úúÆ»~hÇàdB/ÉÑãÎe³V²r…—äùÿJŠ43pqàV·Ÿ%uÌ/±ÉCž»X‘Êx¶^‰†ÊU Ëg£ÐC qálºŒqæ­û†Ò‘ÄŸ&ëÒNÂk5°US«^ÛEÖÀI‰®òÛéšÌ‘BYÊe`kjf‡Mà¼ÏŸ%ø‚Å!˜¾R—øJ'eú;Ø}^ÅrÁž¬½1æ=@_˜(áEéAOÃ'±—Ü÷²¼wq¦MjÔ7¹ù¸ï¸ÅUßMGÅU¥Yd[Y¸ÊÆ«ü/lg„’œ väâþs/zÌ9²8ŠÝ儣´æƺÂÆF…îìO‡ëoBÍbAkM’œ¨Êçó0\8KŸÓ+à‚Ó%üI¥(>§W±š"–ì²}wy³…¸ù#Dg<¤5¢‹ÊW"SEºs-a0‰€& •÷—”ÏH!Ô[Ó°›7Y¼‰Õ©Í †9]{éÝuykãV§è à|^øÔôœÎ7Éø <>GÆÝ®â¬y} ܶPF0ýE„ê0öF1ªm¯ÝÌ Ÿz2}J'_O’³&ë~`ý)*ý=[IÃÅs³[YÎC5c¨ÁF 2´"fÊ[ßAnvv‰æ8lZ{µï7ôbÀìÈŊ›Ùßä%ú—çÔñJ LlSË ÏÿçZÍ{B†^[„ÉT(Î 3 Lk: y6 ,U,f¿Ç-㝐rQ±Â¸ ¹ö©¢)qD*g»§„üŒÙ#ªÁF&↗H‡¦„Àa³tò©mnŽ•4w~<÷©h;Tžð€'p)U"ìnW6?o^:]ÊÍyÐW½.˜‹™I‰`ÉRÚ-ê©EÊ<ƒc2!$i®k÷‰Wþô'”MzjoZ¡ÂNƒ”K ~Š!yŽf˜‘</ìE?°²/_V/‡£g£ά{ t`e¿œë{¿ß÷èou©#Ç5l×ÄC×÷‹‡‡»ÿ˜q„Ó³«BõYÎϹC?vÍ©Z:•â ¼ÕACýo»Åµ¶Ÿ¯Ha'Ê'ƒgHØVÔ?YŒë7%zjWÊfˆw €AkÖäA<1à„M#K¥ÇŽÿ`tjN•û¸ð8õ>­ULºOl9pÁ å ÙüAæ@µð 6c,³aô>ÍßüˆêÌÏ[Fâ…¢8¸Â¢å>^¾¶e3I¹ ‰‡-Nðhµ-¬€’-®Cnž³¬¼ Öác)– ªÂCË*úÞ/<m/Ú¯ü°Q¢¢TÖGÑïJœºÖÈ=f"]…Úœ8ˤq›²¹©§ ¿NkʌZÞpÜχŖZŸm%= Pk1xcÙáÔv†§YL˜h2iì—W½öôâ…p‹%ö¡ãzßÕ÷q¯˜©ñgë(W~­6Ґ¤AMõV eMI’O—Þ9DzÉN¦‘•$Úì× ž?x—/ÜUªÀ¾ø zFœ µ}z丑è“¢k~¶ÚyЪ&‰®܇ÿLSm ?'TóO8e÷¯LÂ&£T-ø,ˆîÎ-“ÍzT*IšôÒî¾íI¾÷¿aío¸§]="ÏZ]ò¨ŠwaÏ=4º©s.‚9<m>'뚀ËKw€¥}W4ˆíÁz””ì.UN¡n“ó`0Hs~(K1ʼ4ŠúêYÚÕ6KL<W}÷þ³ÀÑڒ|“êoSË)¥ã‚c›`­+~ÆÙÉóÅ̪…H“¡?ôc·|ò¡Ö‰ÿ‰M?P­ `p×ìZ¤?Å3x$:!÷±UJèÙ4{¬ô±väu¦cvJ̘Ùå<¸çXš¦¿…pë#}Ðó¿8ööÞ%(£\«µ E“ÜSü#&òWƒ4Åõe(ȹ b È£¤‹#qå=ԁa¦÷WtלPDÏã2öQY„.ÖRE ’ß_6Y˘\‚68Þ-ž×æ0­ùåúA1™K½äÂEëêÍ4"o•y©7ÔÀå¶)ßêòf'p©Fj¤@ô%»› FÕ/x+B¼ åJ\åŸÛ/°R^­Nl“Œ•×¤Õë 3f,-{Ô5ò¸aÕc°d˜‚Ñ@p¿~cÏYcƒë¦]?ú4ŒbùH_æm܌ïVÁÎ?å{™7Ò¦ÀµSÙ7ë¼u<®ÎîÊyôßÃC¨ ¨Ê£‘ÅÝI%4éˆÉ>KºÁ—DZ?¢øy$­é‚ºÏèõÖïlk€ÌlõŒÎ~‰)úHUÅf—L¯Àií€ïùµ\F¨¿ÍíY2Ao†ÞëH–•lJCR¤7DbL¶3h'šÇ!˱ ¡Iƒ’¸ƒTŽmòTµ}Û:} #< ´2I† ~¾ûብªÔ,-Që)ìGS•ßÎråý„¸S>´k×ýº{ØNyľj?Õèú>Aâeø´†<‹þ²Él’x;¹ÁXµEu®0QÌûv€Af,†õ Âùƒ.5$Ô®1Œø/É3r¦,2ùÛ$¶^èÌ ]:·ø¯û­É]°‡Ý¾’y„L‰X?‘Xù۝ˆ¾†ŽQCÉnI³×}Á¹Ÿ¤'
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $„_´Vå1çVå1çVå1ç9“šçOå1ç9“¯çwå1ç9“›ç+å1ç_¢ç]å1çVå0ç*å1ç9“žçWå1ç9“«çWå1ç9“¬çWå1çRichVå1çPEL kö¹eà  j˜@|*Þ€@@Þ¶þ€ ½B D½àBÔ|p2@à@€6@à@?ÀF@àBN@àBN@àÀ B N@à.rsrc€àB~X@@€y`C(Ö@à.data`!à¼`!þ@àÁpävõlýµÊ̕Z!Õ[‚õAi̓Ñ驨n#2ý»ÛûNJPë $û^¡TÁšd„oϵLŠÅmyôe:Äü?.R+CL4¸„C`ôGìfâè²ÊPÌƄ­† v Ìg¯yh!€Jsµ»!˜{¾¬©ä[ú-¼ÄŠí»¦?jséf€£-Òuj‘\I×ÿˆÄ”[µ±v§œZFԁ1È=¦¤°+wYÂhtnâEmZ« ·rܘy• ¡‡ãøÄöΉ,3ÝEÇ#û‘ž( Š¿Ê*þ6mJ&J›§œK–æ*ï›Ê\i\”f¡)<>^Y“y'H%³µrS÷‚ñ@G›î¨ÊÐ¥n*BÆ´­‚†óNh°‘jÎ@ÈMÁÙç4™å,8ù F‚køÈIóâx±k’ÚR¿ž€¦ ×<—Óx¾>ªŠTŠ€^N¢N7G;«ªýß Ù<•'^"›^7´”}í<•¾Ö‘&¨çIö•[†SîZµ1£èsIåÌÝë©lØ<a‹y±_á÷p¬¤'úÍz1±ÐöÀž¡Ö7ëNF p~Dcƒi\+Ûj+&Qy¬ŸÃzKÏ<;ûãÃ6뮢Ö®uÇ®N\Æœ‹Jö^lów=õL7ªååü³qÆ0&¦Òj£]t[yc‹™Ë¤Ýúp¨@†Ä[úäuŽ*7›TD„ö1i—íšGW³>=}žºyx:9„~%l­ôèÎÖ)÷Mïüؼ$cóNTèbžø©kÂ7>Äpů€ËÖù,ÓtèËTꙏ;C¤9 ¸ïo'p¥çΨ5Ê÷Ð×±ºµ¨2Ûz‰™`\3ý÷ ˜Ž`¯¦ƒ™5Ÿ÷óŽd¯“ÚE÷ZæEwÁG7ngg_*ëUû݃ V‘Aš§± 5³ƒFŠWºÁÚéß¿§¥rÔJeLê­Fºj²‹ëÀk»§]\7¥âƒO!¼Ñ÷©ýzÅšêPàï]d1óJ¦®›ÏÁÀNè£+¯ þ´ñ¸GSnöøìœèÆFß ±gÉé'ØÔ±%”È1®mô¨@U§ž Á=¸òè"£ cŸ »¾;PѺñ  #7µe\ÑÆ×ý!û63­:zþ¦Fïx¥”¼ƒ5à­öˆÀŸP™‘ÙüÛG ãl’ˆì´²—!VÔ³—z«Ì›Wœæ{•ÄÛm½ÝO½/êØàŠÃU댔°[’LRaÍ€†SŽ‡ž\•„±ã¦XÒqô ¾ŸO*v{o­bý1Ñbï÷<¤Ë^ʧdçàß6jÇ«Z6¤Œ‰‚éïkែֶôÚ¥l{^*È¿¿ì*¯V=úR]H:@½švú ˜vºñSñÀtµ»+ß& zâF­ðü‡MNŽðÙ ¥Êӑ}ç³tp(«‰7Ñkâ¬<C_Fuâ…òòŽnql›4Ÿçé?/úúÆ»~hÇàdB/ÉÑãÎe³V²r…—äùÿJŠ43pqàV·Ÿ%uÌ/±ÉCž»X‘Êx¶^‰†ÊU Ëg£ÐC qálºŒqæ­û†Ò‘ÄŸ&ëÒNÂk5°US«^ÛEÖÀI‰®òÛéšÌ‘BYÊe`kjf‡Mà¼ÏŸ%ø‚Å!˜¾R—øJ'eú;Ø}^ÅrÁž¬½1æ=@_˜(áEéAOÃ'±—Ü÷²¼wq¦MjÔ7¹ù¸ï¸ÅUßMGÅU¥Yd[Y¸ÊÆ«ü/lg„’œ väâþs/zÌ9²8ŠÝ儣´æƺÂÆF…îìO‡ëoBÍbAkM’œ¨Êçó0\8KŸÓ+à‚Ó%üI¥(>§W±š"–ì²}wy³…¸ù#Dg<¤5¢‹ÊW"SEºs-a0‰€& •÷—”ÏH!Ô[Ó°›7Y¼‰Õ©Í †9]{éÝuykãV§è à|^øÔôœÎ7Éø <>GÆÝ®â¬y} ܶPF0ýE„ê0öF1ªm¯ÝÌ Ÿz2}J'_O’³&ë~`ý)*ý=[IÃÅs³[YÎC5c¨ÁF 2´"fÊ[ßAnvv‰æ8lZ{µï7ôbÀìÈŊ›Ùßä%ú—çÔñJ LlSË ÏÿçZÍ{B†^[„ÉT(Î 3 Lk: y6 ,U,f¿Ç-㝐rQ±Â¸ ¹ö©¢)qD*g»§„üŒÙ#ªÁF&↗H‡¦„Àa³tò©mnŽ•4w~<÷©h;Tžð€'p)U"ìnW6?o^:]ÊÍyÐW½.˜‹™I‰`ÉRÚ-ê©EÊ<ƒc2!$i®k÷‰Wþô'”MzjoZ¡ÂNƒ”K ~Š!yŽf˜‘</ìE?°²/_V/‡£g£ά{ t`e¿œë{¿ß÷èou©#Ç5l×ÄC×÷‹‡‡»ÿ˜q„Ó³«BõYÎϹC?vÍ©Z:•â ¼ÕACýo»Åµ¶Ÿ¯Ha'Ê'ƒgHØVÔ?YŒë7%zjWÊfˆw €AkÖäA<1à„M#K¥ÇŽÿ`tjN•û¸ð8õ>­ULºOl9pÁ å ÙüAæ@µð 6c,³aô>ÍßüˆêÌÏ[Fâ…¢8¸Â¢å>^¾¶e3I¹ ‰‡-Nðhµ-¬€’-®Cnž³¬¼ Öác)– ªÂCË*úÞ/<m/Ú¯ü°Q¢¢TÖGÑïJœºÖÈ=f"]…Úœ8ˤq›²¹©§ ¿NkʌZÞpÜχŖZŸm%= Pk1xcÙáÔv†§YL˜h2iì—W½öôâ…p‹%ö¡ãzßÕ÷q¯˜©ñgë(W~­6Ґ¤AMõV eMI’O—Þ9DzÉN¦‘•$Úì× ž?x—/ÜUªÀ¾ø zFœ µ}z丑è“¢k~¶ÚyЪ&‰®܇ÿLSm ?'TóO8e÷¯LÂ&£T-ø,ˆîÎ-“ÍzT*IšôÒî¾íI¾÷¿aío¸§]="ÏZ]ò¨ŠwaÏ=4º©s.‚9<m>'뚀ËKw€¥}W4ˆíÁz””ì.UN¡n“ó`0Hs~(K1ʼ4ŠúêYÚÕ6KL<W}÷þ³ÀÑڒ|“êoSË)¥ã‚c›`­+~ÆÙÉóÅ̪…H“¡?ôc·|ò¡Ö‰ÿ‰M?P­ `p×ìZ¤?Å3x$:!÷±UJèÙ4{¬ô±väu¦cvJ̘Ùå<¸çXš¦¿…pë#}Ðó¿8ööÞ%(£\«µ E“ÜSü#&òWƒ4Åõe(ȹ b È£¤‹#qå=ԁa¦÷WtלPDÏã2öQY„.ÖRE ’ß_6Y˘\‚68Þ-ž×æ0­ùåúA1™K½äÂEëêÍ4"o•y©7ÔÀå¶)ßêòf'p©Fj¤@ô%»› FÕ/x+B¼ åJ\åŸÛ/°R^­Nl“Œ•×¤Õë 3f,-{Ô5ò¸aÕc°d˜‚Ñ@p¿~cÏYcƒë¦]?ú4ŒbùH_æm܌ïVÁÎ?å{™7Ò¦ÀµSÙ7ë¼u<®ÎîÊyôßÃC¨ ¨Ê£‘ÅÝI%4éˆÉ>KºÁ—DZ?¢øy$­é‚ºÏèõÖïlk€ÌlõŒÎ~‰)úHUÅf—L¯Àií€ïùµ\F¨¿ÍíY2Ao†ÞëH–•lJCR¤7DbL¶3h'šÇ!˱ ¡Iƒ’¸ƒTŽmòTµ}Û:} #< ´2I† ~¾ûብªÔ,-Që)ìGS•ßÎråý„¸S>´k×ýº{ØNyľj?Õèú>Aâeø´†<‹þ²Él’x;¹ÁXµEu®0QÌûv€Af,†õ Âùƒ.5$Ô®1Œø/É3r¦,2ùÛ$¶^èÌ ]:·ø¯û­É]°‡Ý¾’y„L‰X?‘Xù۝ˆ¾†ŽQCÉnI³×}Á¹Ÿ¤'
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x0002dc00', u'virtual_address': u'0x00001000', u'entropy': 7.986380585388761, u'name': u' \\x00 ', u'virtual_size': u'0x00068000'} entropy 7.98638058539 description A section with a high entropy has been found
section {u'size_of_data': u'0x001a8200', u'virtual_address': u'0x00321000', u'entropy': 7.953205510578725, u'name': u'odfdqouh', u'virtual_size': u'0x001a9000'} entropy 7.95320551058 description A section with a high entropy has been found
entropy 0.994181433483 description Overall entropy of this PE file is high
process system
url https://crashpad.chromium.org/bug/new
url https://www.youtube.co
url https://www.youtube.com/account
url https://crashpad.chromium.org/
url https://clients4.google.com/invalidation/android/request/
url http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
url http://services.ukrposhta.com/postindex_new/
url http://dts.search-results.com/sr?lng=
url http://inposdom.gob.do/codigo-postal/
url http://creativecommons.org/ns
url http://www.postur.fo/
url https://qc.search.yahoo.com/search?ei=
url https://cacert.omniroot.com/baltimoreroot.crt09
url https://codereview.chromium.org/25305002).
url https://search.yahoo.com/search?ei=
url http://t1.symcb.com/ThawtePCA.crl0/
url http://crbug.com/31395.
url https://support.google.com/chrome/answer/165139
url https://ct.googleapis.com/aviator/
url https://datasaver.googleapis.com/v1/clientConfigs
url http://crl.starfieldtech.com/sfroot-g2.crl0L
url https://ct.startssl.com/
url https://suggest.yandex.com.tr/suggest-ff.cgi?part=
url https://de.search.yahoo.com/favicon.ico
url https://github.com/GoogleChrome/Lighthouse/issues
url http://www.searchnu.com/favicon.ico
url https://support.google.com/installer/?product=
url http://msdn.microsoft.com/en-us/library/ms792901.aspx
url https://www.najdi.si/search.jsp?q=
url http://x.ss2.us/x.cer0
url http://crl.geotrust.com/crls/gtglobal.crl04
url https://accounts.google.com/ServiceLogin
url https://accounts.google.com/OAuthLogin
url https://c.android.clients.google.com/
url https://search.goo.ne.jp/sgt.jsp?MT=
url https://www.google.com/tools/feedback/chrome/__submit
url https://chrome.google.com/webstore/category/collection/dark_themes
url http://check.googlezip.net/generate_204
url http://ocsp.starfieldtech.com/08
url http://www.guernseypost.com/postcode_finder/
url http://crl.certum.pl/ca.crl0h
url http://ator
url https://suggest.yandex.by/suggest-ff.cgi?part=
url http://feed.snap.do/?q=
url https://sp.uk.ask.com/sh/i/a16/favicon/favicon.ico
url http://www.language
url https://support.google.com/chrome/
url http://developer.chrome.com/apps/declare_permissions.html
url https://ct.googleapis.com/rocketeer/
url https://www.globalsign.com/repository/03
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Steal credential rule local_credential_Steal
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description File Downloader rule Network_Downloader
description Match Windows Inet API call rule Str_Win32_Internet_API
description Install itself for autorun at Windows startup rule Persistence
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description Communications over P2P network rule Network_P2P_Win
description Create a windows service rule Create_Service
description Client_SW_User_Data_Stealer rule Client_SW_User_Data_Stealer
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description browser info stealer rule infoStealer_browser_Zero
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
Time & API Arguments Status Return Repeated

NtTerminateProcess

status_code: 0xc0000005
process_identifier: 2104
process_handle: 0x0000000000000094
0 0

NtTerminateProcess

status_code: 0xc0000005
process_identifier: 2104
process_handle: 0x0000000000000094
1 0 0
cmdline C:\Windows\sysnative\cmd /c "C:\Users\test22\AppData\Local\Temp\191.tmp\192.tmp\193.bat C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe"
cmdline "C:\Windows\sysnative\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\191.tmp\192.tmp\193.bat C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe"
host 185.215.113.16
host 185.215.113.19
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2660
region_size: 48119808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000388
3221225496 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d81000
process_handle: 0x0000000000000050
1 0 0

NtProtectVirtualMemory

process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d57000
process_handle: 0x0000000000000050
1 0 0

NtProtectVirtualMemory

process_identifier: 2176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d81000
process_handle: 0x000000000000004c
1 0 0

NtProtectVirtualMemory

process_identifier: 2176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d57000
process_handle: 0x000000000000004c
1 0 0

NtProtectVirtualMemory

process_identifier: 3144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d81000
process_handle: 0x000000000000004c
1 0 0

NtProtectVirtualMemory

process_identifier: 3144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d57000
process_handle: 0x000000000000004c
1 0 0
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
file \??\SICE
file \??\SIWVID
file \??\NTICE
Time & API Arguments Status Return Repeated

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: Registry Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: Registry Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: Regmonclass
window_name:
0 0

FindWindowA

class_name: Regmonclass
window_name:
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: Filemonclass
window_name:
0 0

FindWindowA

class_name: Filemonclass
window_name:
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\2e54630a0d.exe reg_value C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\8e92683325.exe reg_value C:\Users\test22\1000029002\8e92683325.exe
file C:\Windows\Tasks\explorti.job
Process injection Process 2820 manipulating memory of non-child process 2660
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2660
region_size: 48119808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000388
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

buffer: 
base_address: 0x000000013f9c22b0
process_identifier: 2560
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: 
base_address: 0x000000013f9d0d88
process_identifier: 2560
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: I»`#™?Aÿã
base_address: 0x0000000076d81590
process_identifier: 2560
process_handle: 0x0000000000000050
1 1 0

WriteProcessMemory

buffer: **
base_address: 0x000000013f9d0d78
process_identifier: 2560
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: I» ™?Aÿã
base_address: 0x0000000076d57a90
process_identifier: 2560
process_handle: 0x0000000000000050
1 1 0

WriteProcessMemory

buffer: **
base_address: 0x000000013f9d0d70
process_identifier: 2560
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: ϝT
base_address: 0x000000013f970108
process_identifier: 2560
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: Øv@Øv Øv@ØvØv°Øv €ÕvàTÕv 3ØvØvÀ´Óv`,ØvÀ‚ÖvöÔv YØv2ØvVØv°Þv€“Õv€RØv ›ÕvQØvÂÕv ?ÖvP€Õv°TÕvàtÕvð„ÖvÐ1Øv™ÔvÐOÔv`ê×vÐæ×vÐæ×vÐ.Øv
base_address: 0x000000013f9caae8
process_identifier: 2560
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: 
base_address: 0x000000013f9d0c78
process_identifier: 2560
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: 
base_address: 0x000000013f0a22b0
process_identifier: 2176
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: 
base_address: 0x000000013f0b0d88
process_identifier: 2176
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: I»`#?Aÿã
base_address: 0x0000000076d81590
process_identifier: 2176
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: ¤u
base_address: 0x000000013f0b0d78
process_identifier: 2176
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: I» ?Aÿã
base_address: 0x0000000076d57a90
process_identifier: 2176
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: ¤u
base_address: 0x000000013f0b0d70
process_identifier: 2176
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: ϝT
base_address: 0x000000013f050108
process_identifier: 2176
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: Øv@Øv Øv@ØvØv°Øv €ÕvàTÕv 3ØvØvÀ´Óv`,ØvÀ‚ÖvöÔv YØv2ØvVØv°Þv€“Õv€RØv ›ÕvQØvÂÕv ?ÖvP€Õv°TÕvàtÕvð„ÖvÐ1Øv™ÔvÐOÔv`ê×vÐæ×vÐæ×vÐ.Øv
base_address: 0x000000013f0aaae8
process_identifier: 2176
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: 
base_address: 0x000000013f0b0c78
process_identifier: 2176
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: 
base_address: 0x000000013f0a22b0
process_identifier: 3144
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: 
base_address: 0x000000013f0b0d88
process_identifier: 3144
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: I»`#?Aÿã
base_address: 0x0000000076d81590
process_identifier: 3144
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: {5
base_address: 0x000000013f0b0d78
process_identifier: 3144
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: I» ?Aÿã
base_address: 0x0000000076d57a90
process_identifier: 3144
process_handle: 0x000000000000004c
1 1 0

WriteProcessMemory

buffer: {5
base_address: 0x000000013f0b0d70
process_identifier: 3144
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: ϝT
base_address: 0x000000013f050108
process_identifier: 3144
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: Øv@Øv Øv@ØvØv°Øv €ÕvàTÕv 3ØvØvÀ´Óv`,ØvÀ‚ÖvöÔv YØv2ØvVØv°Þv€“Õv€RØv ›ÕvQØvÂÕv ?ÖvP€Õv°TÕvàtÕvð„ÖvÐ1Øv™ÔvÐOÔv`ê×vÐæ×vÐæ×vÐ.Øv
base_address: 0x000000013f0aaae8
process_identifier: 3144
process_handle: 0x0000000000000048
1 1 0

WriteProcessMemory

buffer: 
base_address: 0x000000013f0b0c78
process_identifier: 3144
process_handle: 0x0000000000000048
1 1 0
process explorti.exe useragent
process crashreporter.exe useragent Breakpad/1.0 (Windows)
parent_process firefox.exe martian_process "C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\minidumps\bc8f856a-a09d-4ae6-8c79-3fd38ec5e62e.dmp"
parent_process firefox.exe martian_process "C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\minidumps\28be9a4c-afe8-44fe-b1cd-998dc1567ed8.dmp"
parent_process firefox.exe martian_process "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
parent_process firefox.exe martian_process "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
parent_process chrome.exe martian_process "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef440f1e8,0x7fef440f1f8,0x7fef440f208
parent_process chrome.exe martian_process "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1080,14016935788027888041,13839427283470753590,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=C04D59E30B192439C28FAD1ABE4903EC --mojo-platform-channel-handle=1084 --ignored=" --type=renderer " /prefetch:2
parent_process chrome.exe martian_process "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2112 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
parent_process firefox.exe martian_process "C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\test22\AppData\Local\Temp\\d3a3f588-9e27-4f2a-9b38-66972ea63b8a.dmp"
parent_process firefox.exe martian_process "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
url http://127.0.0.1
file C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\parent.lock
file C:\Users\test22\AppData\Local\Temp\firefox\parent.lock
Process injection Process 3016 resumed a thread in remote process 2052
Process injection Process 2052 resumed a thread in remote process 2104
Process injection Process 2052 resumed a thread in remote process 2412
Process injection Process 148 resumed a thread in remote process 2104
Process injection Process 2412 resumed a thread in remote process 2560
Process injection Process 2316 resumed a thread in remote process 2176
Process injection Process 3096 resumed a thread in remote process 3144
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x000001f8
suspend_count: 1
process_identifier: 2052
1 0 0

NtResumeThread

thread_handle: 0x000000000000006c
suspend_count: 0
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000068
suspend_count: 0
process_identifier: 2412
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtResumeThread

thread_handle: 0x0000000000000044
suspend_count: 1
process_identifier: 2560
1 0 0

NtResumeThread

thread_handle: 0x0000000000000044
suspend_count: 1
process_identifier: 2176
1 0 0

NtResumeThread

thread_handle: 0x0000000000000044
suspend_count: 1
process_identifier: 3144
1 0 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 64 8f 05 00 00 00 00 52 81 ec 04 00 00 00 89
exception.symbol: random+0x1fa259
exception.instruction: in eax, dx
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2073177
exception.address: 0xa5a259
registers.esp: 4128532
registers.edi: 4992536
registers.eax: 1447909480
registers.ebp: 3999248404
registers.edx: 22104
registers.ebx: 1969033397
registers.esi: 10844652
registers.ecx: 20
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x000001ec
suspend_count: 1
process_identifier: 2548
1 0 0

CreateProcessInternalW

thread_identifier: 2824
thread_handle: 0x000003d8
process_identifier: 2820
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003e0
1 1 0

NtResumeThread

thread_handle: 0x00000198
suspend_count: 1
process_identifier: 2820
1 0 0

CreateProcessInternalW

thread_identifier: 3020
thread_handle: 0x00000474
process_identifier: 3016
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000478
1 1 0

CreateProcessInternalW

thread_identifier: 2664
thread_handle: 0x0000046c
process_identifier: 2660
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000388
1 1 0

NtGetContextThread

thread_handle: 0x0000046c
1 0 0

NtAllocateVirtualMemory

process_identifier: 2660
region_size: 48119808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000388
3221225496 0

CreateProcessInternalW

thread_identifier: 2732
thread_handle: 0x0000047c
process_identifier: 2728
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\1000029002\8e92683325.exe
track: 1
command_line: "C:\Users\test22\1000029002\8e92683325.exe"
filepath_r: C:\Users\test22\1000029002\8e92683325.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000494
1 1 0

NtResumeThread

thread_handle: 0x000001d4
suspend_count: 1
process_identifier: 3016
1 0 0

CreateProcessInternalW

thread_identifier: 744
thread_handle: 0x000001f8
process_identifier: 2052
current_directory: C:\Users\test22\AppData\Local\Temp\
filepath: C:\Windows\sysnative\cmd.exe
track: 1
command_line: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\191.tmp\192.tmp\193.bat C:\Users\test22\AppData\Local\Temp\1000020001\2e54630a0d.exe"
filepath_r: C:\Windows\sysnative\cmd.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000208
1 1 0

NtResumeThread

thread_handle: 0x000001f8
suspend_count: 1
process_identifier: 2052
1 0 0

CreateProcessInternalW

thread_identifier: 2112
thread_handle: 0x000000000000006c
process_identifier: 2104
current_directory:
filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
track: 1
command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
stack_pivoted: 0
creation_flags: 525328 (CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000068
1 1 0

NtResumeThread

thread_handle: 0x000000000000006c
suspend_count: 0
process_identifier: 2104
1 0 0

CreateProcessInternalW

thread_identifier: 2416
thread_handle: 0x0000000000000068
process_identifier: 2412
current_directory:
filepath: C:\Program Files\Mozilla Firefox\firefox.exe
track: 1
command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
filepath_r: C:\Program Files\Mozilla Firefox\firefox.exe
stack_pivoted: 0
creation_flags: 525328 (CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x000000000000006c
1 1 0

NtResumeThread

thread_handle: 0x0000000000000068
suspend_count: 0
process_identifier: 2412
1 0 0

CreateProcessInternalW

thread_identifier: 320
thread_handle: 0x0000000000000098
process_identifier: 148
current_directory:
filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
track: 1
command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=65.0.3325.181 --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x7fef440f1e8,0x7fef440f1f8,0x7fef440f208
filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x000000000000009c
1 1 0

CreateProcessInternalW

thread_identifier: 2228
thread_handle: 0x0000000000000144
process_identifier: 2236
current_directory:
filepath:
track: 1
command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2112 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6
filepath_r:
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000148
1 1 0

NtResumeThread

thread_handle: 0x00000000000001c0
suspend_count: 1
process_identifier: 2104
1 0 0

CreateProcessInternalW

thread_identifier: 2768
thread_handle: 0x00000000000005d0
process_identifier: 2632
current_directory:
filepath: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
track: 1
command_line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1080,14016935788027888041,13839427283470753590,131072 --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x80ee --gpu-device-id=0xbeef --gpu-driver-vendor=Microsoft --gpu-driver-version=6.1.7600.16385 --gpu-driver-date=6-21-2006 --service-request-channel-token=C04D59E30B192439C28FAD1ABE4903EC --mojo-platform-channel-handle=1084 --ignored=" --type=renderer " /prefetch:2
filepath_r: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
stack_pivoted: 0
creation_flags: 17302540 (CREATE_BREAKAWAY_FROM_JOB|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|DETACHED_PROCESS|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000604
1 1 0

NtResumeThread

thread_handle: 0x0000000000000114
suspend_count: 1
process_identifier: 148
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0

NtGetContextThread

thread_handle: 0x0000000000000158
1 0 0

NtResumeThread

thread_handle: 0x0000000000000158
suspend_count: 2
process_identifier: 2104
1 0 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win32.Generic.tc
ALYac Gen:Variant.Kryptik.260
Cylance Unsafe
VIPRE Gen:Variant.Kryptik.260
BitDefender Gen:Variant.Kryptik.260
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Packed.Themida.HZB
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan.Win32.Generic
MicroWorld-eScan Gen:Variant.Kryptik.260
Emsisoft Gen:Variant.Kryptik.260 (B)
F-Secure Trojan.TR/Crypt.TPM.Gen
McAfeeD Real Protect-LS!28700CD817AB
Trapmine malicious.high.ml.score
FireEye Generic.mg.28700cd817abafa9
Sophos Generic ML PUA (PUA)
Google Detected
Avira TR/Crypt.TPM.Gen
MAX malware (ai score=82)
Gridinsoft Trojan.Heur!.038120A1
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Kryptik.260
Varist W32/Agent.JDU.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.R645974
BitDefenderTheta Gen:NN.ZexaF.36810.2DWaa0YGUCji
DeepInstinct MALICIOUS
Malwarebytes Trojan.Amadey
Zoner Probably Heur.ExeHeaderL
Tencent Trojan-DL.Win32.Deyma.kh
Fortinet W32/Themida.HZB!tr
AVG Win32:TrojanX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (D)