Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 19, 2024, 9:36 a.m.	Sept. 19, 2024, 9:47 a.m.

Size	894.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`837bbda2bbdf75c019f3581afb0fc9d4`
SHA256	`a094b0cc4ae679c7cc50aaea4a59d08fb7db868148c7d0e79baf831d34d6171d`
CRC32	`C4F6FD9D`
ssdeep	`24576:0NA3R5drX/Wjw8to/ZAbGnVRqyiHOB8nDFQXi7hQHQ:V5OsVxYGnVRqyiHOi0i7hQw`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

66e9c0921c144_111.exe#111 "C:\Users\test22\AppData\Local\Temp\66e9c0921c144_111.exe#111"
2568
- 1.exe "C:\Windows\Temp\1.exe"
  2780
  - RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    2952
- 2.exe "C:\Windows\Temp\2.exe"
  2820

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
107.189.171.131	Active	Moloch
193.233.255.84	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 193.233.255.84:4284 -> 192.168.56.101:49171	2400036	ET DROP Spamhaus DROP Listed Traffic Inbound group 37	Misc Attack
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043233	ET INFO Microsoft net.tcp Connection Initialization Activity	Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043233	ET INFO Microsoft net.tcp Connection Initialization Activity	Potentially Bad Traffic
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	A Network Trojan was detected
TCP 193.233.255.84:4284 -> 192.168.56.101:49171	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 107.189.171.131:14307 -> 192.168.56.101:49170	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 193.233.255.84:4284 -> 192.168.56.101:49171	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	A Network Trojan was detected
TCP 107.189.171.131:14307 -> 192.168.56.101:49170	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49171 -> 193.233.255.84:4284	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 107.189.171.131:14307	2043231	ET MALWARE Redline Stealer TCP CnC Activity	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (26 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 18, 2024, 7:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:22 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2024, 7:23 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 18, 2024, 7:22 p.m.			0	0
IsDebuggerPresent Sept. 18, 2024, 7:22 p.m.			0	0
IsDebuggerPresent Sept. 18, 2024, 7:22 p.m.			0	0
IsDebuggerPresent Sept. 18, 2024, 7:22 p.m.			0	0
IsDebuggerPresent Sept. 18, 2024, 7:22 p.m.			0	0
IsDebuggerPresent Sept. 18, 2024, 7:22 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (47 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d0170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d0170 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d01b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d01b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d05b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d05b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d04b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d05f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d05f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d05f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d05f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d0c30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d0c30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x008d0df0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e88868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e88868 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x05e88728 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef480 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef500 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef500 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef400 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007efc00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007efc00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:22 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007efdc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007efa40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007efa40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2024, 7:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007ef780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 18, 2024, 7:22 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (50 out of 118 events)

Time & API	Arguments	Status
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 07 66 0f 7f 47 10 66 0f 7f 47 20 66 0f exception.symbol: 2+0xefe7 exception.address: 0x40efe7 exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61415 registers.esp: 1636976 registers.edi: 4465840 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1476	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4468656 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1454	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4472752 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1422	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4476848 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1390	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4480944 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1358	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4485040 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1326	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4489136 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1294	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4493232 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1262	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4497328 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1230	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4501424 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1198	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4505520 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1166	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4509616 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1134	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4513712 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1102	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4517808 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1070	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4521904 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1038	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4526000 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 1006	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4530096 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 974	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4534192 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 942	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4538288 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 910	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4542384 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 878	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4546480 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 846	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4550576 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 814	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4554672 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 782	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4558768 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 750	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4562864 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 718	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4566960 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 686	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4571056 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 654	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4575152 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 622	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4579248 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 590	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4583344 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 558	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4587440 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 526	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4591536 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 494	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4595632 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 462	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4599728 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 430	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4603824 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 398	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4607920 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 366	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4612016 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 334	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4616112 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 302	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4620208 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 270	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4624304 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 238	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4628400 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 206	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4632496 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 174	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4636592 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 142	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4640688 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 110	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4644784 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 78	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4648880 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 46	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 2+0xf054 @ 0x40f054 2+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: 2+0xefff exception.address: 0x40efff exception.module: 2.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636976 registers.edi: 4652976 registers.eax: 4465840 registers.ebp: 1636980 registers.edx: 91 registers.ebx: 0 registers.esi: 32833608 registers.ecx: 14	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737 mscorlib+0x2d3711 @ 0x71603711 mscorlib+0x308f2d @ 0x71638f2d mscorlib+0x3133fd @ 0x716433fd mscorlib+0x9873b1 @ 0x71cb73b1 mscorlib+0x97b352 @ 0x71cab352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x722f2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x723ecd14 0x3fa062 2+0x2403 @ 0x402403 exception.instruction_r: 8b 01 8b 40 38 ff 50 14 8b 15 3c 21 40 03 8b c8 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x23802a6 registers.esp: 1635236 registers.edi: 37774016 registers.eax: 0 registers.ebp: 1635272 registers.edx: 37767464 registers.ebx: 37767464 registers.esi: 13 registers.ecx: 0	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 0x62a0306 0x62a00be 0x55d9615 0x55d91ee 0x238f4e3 0x238ef6d 0x238eed0 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737 mscorlib+0x2d3711 @ 0x71603711 mscorlib+0x308f2d @ 0x71638f2d 0x23803cb DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737 mscorlib+0x2d3711 @ 0x71603711 mscorlib+0x308f2d @ 0x71638f2d mscorlib+0x3133fd @ 0x716433fd mscorlib+0x9873b1 @ 0x71cb73b1 mscorlib+0x97b352 @ 0x71cab352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x722f2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x723ecd14 0x3fa062 2+0x2403 @ 0x402403 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62a0430 registers.esp: 1633116 registers.edi: 1633168 registers.eax: 0 registers.ebp: 1633180 registers.edx: 9141824 registers.ebx: 1634804 registers.esi: 39478516 registers.ecx: 0	1
__exception__ Sept. 18, 2024, 7:22 p.m.	stacktrace: 0x62a4b6e 0x62a4a27 0x62a4925 0x62a2ad6 0x62a0a9d 0x62a0967 0x55d96dd 0x55d91ee 0x238f4e3 0x238ef6d 0x238eed0 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737 mscorlib+0x2d3711 @ 0x71603711 mscorlib+0x308f2d @ 0x71638f2d 0x23803cb DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737 mscorlib+0x2d3711 @ 0x71603711 mscorlib+0x308f2d @ 0x71638f2d mscorlib+0x3133fd @ 0x716433fd mscorlib+0x9873b1 @ 0x71cb73b1 mscorlib+0x97b352 @ 0x71cab352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x722f2a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x723ecd14 0x3fa062 2+0x2403 @ 0x402403 exception.instruction_r: 39 09 ff 15 b8 2c 39 02 89 85 44 ff ff ff 8b 85 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x62a5546 registers.esp: 1631612 registers.edi: 1631852 registers.eax: 0 registers.ebp: 1631864 registers.edx: 37301320 registers.ebx: 1634804 registers.esi: 39992272 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 207 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722f2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02421000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02220000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722f2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0063b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00637000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00635000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02381000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0238d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00626000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0062a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00627000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0238e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0061a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0238f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2820 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x055d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (7 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\lockfile
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State

Creates executable files on the filesystem (2 events)

file	C:\Windows\Temp\2.exe
file	C:\Windows\Temp\1.exe

Creates hidden or system file (8 events)

Time & API	Arguments	Return
NtCreateFile Sept. 18, 2024, 7:22 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 18, 2024, 7:22 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 18, 2024, 7:22 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 18, 2024, 7:22 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 18, 2024, 7:22 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 18, 2024, 7:22 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 18, 2024, 7:22 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 18, 2024, 7:22 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525

Drops a binary and executes it (2 events)

file	C:\Windows\Temp\1.exe
file	C:\Windows\Temp\2.exe

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000e200', u'virtual_address': u'0x0005d000', u'entropy': 6.802287495720708, u'name': u'.rsrc', u'virtual_size': u'0x0000e034'}

entropy

6.80228749572

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 18, 2024, 7:22 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 18, 2024, 7:23 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (11 events)

description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 78 events)

Time & API	Arguments	Status
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000548 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: AddressBook base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: Connection Manager base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: DirectDrawEx base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: EditPlus base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: ENTERPRISE base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: Fontcore base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: Google Chrome base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: IE40 base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: IE4Data base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: IE5BAKEX base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: IEData base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: MobileOptionPack base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: SchedulingAgent base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: WIC base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x00000548 key_handle: 0x0000054c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000003d8 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: AddressBook base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: Connection Manager base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: DirectDrawEx base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: EditPlus base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: ENTERPRISE base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: Fontcore base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: Google Chrome base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: IE40 base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 18, 2024, 7:23 p.m.	regkey_r: IE4Data base_handle: 0x000003d8 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT * FROM Win32_Processor

Communicates with host for which no DNS query was performed (2 events)

host	107.189.171.131
host	193.233.255.84

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2952 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 18, 2024, 7:22 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (9 events)

wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_OperatingSystem
wmi	SELECT * FROM Win32_Process Where SessionId='1'
wmi	SELECT * FROM Win32_Process
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_Processor

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿ%¿à0ìÐ*º @ @Ø¹O ÄÉ¼¹ H.textê ì `.rsrcÄÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2952 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: °,: base_address: 0x00450000 process_identifier: 2952 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2952 process_handle: 0x00000240	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿ%¿à0ìÐ*º @ @Ø¹O ÄÉ¼¹ H.textê ì `.rsrcÄÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2952 process_handle: 0x00000240	1	1	0

Collects information about installed applications (50 out of 54 events)

Time & API	Arguments	Status
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x0000054c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 18, 2024, 7:23 p.m.	key_handle: 0x00000330 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2780 called NtSetContextThread to modify thread in remote process 2952
NtSetContextThread Sept. 18, 2024, 7:22 p.m.	registers.eip: 1995571652 registers.esp: 3079408 registers.edi: 0 registers.eax: 4373034 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2952	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2780 resumed a thread in remote process 2952
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2952	1	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 86 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x00000180 suspend_count: 1 process_identifier: 2568	1	0
CreateProcessInternalW Sept. 18, 2024, 7:22 p.m.	thread_identifier: 2784 thread_handle: 0x00000280 process_identifier: 2780 current_directory: C:\Windows\Temp filepath: C:\Windows\Temp\1.exe track: 1 command_line: "C:\Windows\Temp\1.exe" filepath_r: C:\Windows\Temp\1.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000027c	1	1
CreateProcessInternalW Sept. 18, 2024, 7:22 p.m.	thread_identifier: 2824 thread_handle: 0x000001d8 process_identifier: 2820 current_directory: C:\Windows\Temp filepath: C:\Windows\Temp\2.exe track: 1 command_line: "C:\Windows\Temp\2.exe" filepath_r: C:\Windows\Temp\2.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002a8	1	1
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2780	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2780	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2780	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 2780	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x00000214 suspend_count: 1 process_identifier: 2780	1	0
CreateProcessInternalW Sept. 18, 2024, 7:22 p.m.	thread_identifier: 2956 thread_handle: 0x0000023c process_identifier: 2952 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000240	1	1
NtGetContextThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x0000023c	1	0
NtAllocateVirtualMemory Sept. 18, 2024, 7:22 p.m.	process_identifier: 2952 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000240	1	0
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿ%¿à0ìÐ*º @ @Ø¹O ÄÉ¼¹ H.textê ì `.rsrcÄÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2952 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: base_address: 0x00402000 process_identifier: 2952 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: base_address: 0x00432000 process_identifier: 2952 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: °,: base_address: 0x00450000 process_identifier: 2952 process_handle: 0x00000240	1	1
WriteProcessMemory Sept. 18, 2024, 7:22 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2952 process_handle: 0x00000240	1	1
NtSetContextThread Sept. 18, 2024, 7:22 p.m.	registers.eip: 1995571652 registers.esp: 3079408 registers.edi: 0 registers.eax: 4373034 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2952	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x0000023c suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x000003b0 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x000003e8 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:22 p.m.	thread_handle: 0x0000045c suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000544 suspend_count: 1 process_identifier: 2820	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2820	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtSetContextThread Sept. 18, 2024, 7:23 p.m.	registers.eip: 1916218244 registers.esp: 1632400 registers.edi: 56660091 registers.eax: 104792576 registers.ebp: 1632440 registers.edx: 75 registers.ebx: 0 registers.esi: 75 registers.ecx: 38629136 thread_handle: 0x00000118 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2820	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtSetContextThread Sept. 18, 2024, 7:23 p.m.	registers.eip: 1916218244 registers.esp: 1632400 registers.edi: 70590464 registers.eax: 104792576 registers.ebp: 1632440 registers.edx: 107 registers.ebx: 0 registers.esi: 107 registers.ecx: 38629136 thread_handle: 0x00000118 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2820	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtSetContextThread Sept. 18, 2024, 7:23 p.m.	registers.eip: 1916218244 registers.esp: 1632456 registers.edi: 38629136 registers.eax: 58 registers.ebp: 1632480 registers.edx: 751398 registers.ebx: 182132 registers.esi: 58 registers.ecx: 38629136 thread_handle: 0x00000118 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2820	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtGetContextThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000118 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000558 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x00000450 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x000003d8 suspend_count: 1 process_identifier: 2820	1	0
NtResumeThread Sept. 18, 2024, 7:23 p.m.	thread_handle: 0x000004ac suspend_count: 1 process_identifier: 2820	1	0

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealer.12!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	TrojanSpy.Stealer
Skyhigh	BehavesLike.Win32.AdwareFiseria.cc
ALYac	Dump:Generic.Dacic.6D6C5790.A.AAF4F7E2
Cylance	Unsafe
VIPRE	Gen:Variant.MSILHeracles.179021
Sangfor	Infostealer.Msil.Agent.V5lv
CrowdStrike	win/malicious_confidence_60% (D)
BitDefender	Trojan.GenericKD.74154482
K7GW	Unwanted-Program ( 700000121 )
K7AntiVirus	Unwanted-Program ( 700000121 )
Arcabit	Trojan.Generic.D46B81F2
VirIT	Trojan.Win32.MSIL.HHD
Symantec	Trojan Horse
Elastic	malicious (high confidence)
ESET-NOD32	multiple detections
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Redline-10009299-0
Kaspersky	Trojan-Spy.Win32.Stealer.fjat
Alibaba	TrojanSpy:MSIL/Stealer.dedb1924
MicroWorld-eScan	Trojan.GenericKD.74154482
Rising	Malware.Obfus/MSIL@AI.80 (RDM.MSIL2:t0EHP/wvLY+k1Rjq6V3dQQ)
Emsisoft	Trojan.GenericKD.74154482 (B)
F-Secure	Trojan.TR/AD.Nekark.yufwo
DrWeb	Trojan.PWS.Siggen3.38349
McAfeeD	ti!A094B0CC4AE6
CTX	exe.trojan.msil
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious SFX
FireEye	Generic.mg.837bbda2bbdf75c0
Webroot	W32.Stealer.fjat
Google	Detected
Avira	TR/AD.Nekark.yufwo
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Malware.Win32.RedLine.tr
Xcitium	Malware@#x62feho2qzvb
Microsoft	Trojan:MSIL/Seraph.RG!MTB
ZoneAlarm	Trojan-Spy.Win32.Stealer.fjat
GData	Trojan.GenericKD.74154482
Varist	W32/S-8ed38c1a!Eldorado
McAfee	Artemis!837BBDA2BBDF
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.4225008120
Ikarus	Trojan.MSIL.Crypt
Panda	Trj/CI.A
Tencent	Msil.Trojan.Stelpak.Cflw
Yandex	TrojanSpy.Stealer!1X/0Tf4ZwbE

66e9c0921c144_111.exe#111

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All