Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 3, 2025, 9:58 a.m.	Feb. 3, 2025, 10:02 a.m.

Size	522.5KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`d62a00606fb383476db2c7f057f417f2`
SHA256	`ebe24f9d635e5a1ff23e1b0f41828ffe1b7b0e6de8897eb01ca68fcb0d3b095f`
CRC32	`19C90059`
ssdeep	`12288:3bmxp0YbzIEdxkhZlmlfwaL7LXSkwcs3gv3:rwG4fvLXjKgv`
PDB Path	G:\Projects\Emmet\Emmet\Release\Emmet.pdb
Yara	PE_Header_Zero - PE File Signature Network_Downloader - File Downloader Antivirus - Contains references to security software IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

EmmetPROD.exe "C:\Users\test22\AppData\Local\Temp\EmmetPROD.exe"
1440
- cmd.exe C:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"
  2236
  - WMIC.exe wmic computersystem get name, TotalPhysicalMemory /Value
    2280
  - WMIC.exe wmic os get caption /Value
    2388
  - WMIC.exe wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value
    2464
  - ipconfig.exe ipconfig
    2532
  - find.exe find "IPv4"
    2568
  - find.exe find /N ":"
    2608
  - find.exe find "[1]"
    2648

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
141.147.43.219	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (14 events)

Time & API	Arguments	Status	Return
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 3, 2025, 9:58 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 3, 2025, 9:58 a.m.			0	0
IsDebuggerPresent Feb. 3, 2025, 9:58 a.m.			0	0
IsDebuggerPresent Feb. 3, 2025, 9:58 a.m.			0	0

Command line console output was observed (50 out of 93 events)

Time & API	Arguments	Status	Return
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: S console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: W console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: b console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: S console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: k console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: C console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Feb. 3, 2025, 9:58 a.m.	buffer: t console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

G:\Projects\Emmet\Emmet\Release\Emmet.pdb

One or more processes crashed (6 events)

Time & API	Arguments	Status
__exception__ Feb. 3, 2025, 9:58 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 30471388 registers.edi: 5098396 registers.eax: 30471388 registers.ebp: 30471468 registers.edx: 49 registers.ebx: 30471752 registers.esi: 2147746133 registers.ecx: 4875256	1
__exception__ Feb. 3, 2025, 9:58 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x7532c048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x752f8926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x752fd55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x7532c44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x752fd1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x752fd1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x752fd40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x752f991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x752f8d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x73e76f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x73e76e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x73e727a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x73e72652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x73e7253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x73e72411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x73e725ab wmic+0x39c80 @ 0x209c80 wmic+0x3b06a @ 0x20b06a wmic+0x3b1f8 @ 0x20b1f8 wmic+0x36fcd @ 0x206fcd wmic+0x3d6e9 @ 0x20d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1566032 registers.edi: 1974991376 registers.eax: 1566032 registers.ebp: 1566112 registers.edx: 1 registers.ebx: 4844540 registers.esi: 2147746133 registers.ecx: 3917894090	1
__exception__ Feb. 3, 2025, 9:58 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 48297140 registers.edi: 7719732 registers.eax: 48297140 registers.ebp: 48297220 registers.edx: 49 registers.ebx: 48297504 registers.esi: 2147746133 registers.ecx: 7496656	1
__exception__ Feb. 3, 2025, 9:58 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x7532c048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x752f8926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x752fd55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x7532c44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x752fd1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x752fd1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x752fd40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x752f991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x752f8d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x73e66f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x73e66e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x73e627a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x73e62652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x73e6253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x73e62411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x73e625ab wmic+0x39c80 @ 0x1a9c80 wmic+0x3b06a @ 0x1ab06a wmic+0x3b1f8 @ 0x1ab1f8 wmic+0x36fcd @ 0x1a6fcd wmic+0x3d6e9 @ 0x1ad6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 649744 registers.edi: 1974991376 registers.eax: 649744 registers.ebp: 649824 registers.edx: 1 registers.ebx: 7465980 registers.esi: 2147746133 registers.ecx: 4168461847	1
__exception__ Feb. 3, 2025, 9:58 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387 NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42 NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8 WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6 WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876 WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0 CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43 CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938 DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41 WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367 DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48 CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 49410320 registers.edi: 7531716 registers.eax: 49410320 registers.ebp: 49410400 registers.edx: 49 registers.ebx: 49410684 registers.esi: 2147746133 registers.ecx: 7234904	1
__exception__ Feb. 3, 2025, 9:58 a.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14 StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338 IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d IsValidURL+0x2235 MkParseDisplayNameEx-0x1effb urlmon+0x4c048 @ 0x7532c048 RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7 RegisterBindStatusCallback+0x1ef2 CopyBindInfo-0x2dcb urlmon+0x18926 @ 0x752f8926 RevokeBindStatusCallback+0x13ad CreateURLMoniker-0x4b1 urlmon+0x1d55e @ 0x752fd55e IsValidURL+0x2638 MkParseDisplayNameEx-0x1ebf8 urlmon+0x4c44b @ 0x7532c44b RevokeBindStatusCallback+0x1045 CreateURLMoniker-0x819 urlmon+0x1d1f6 @ 0x752fd1f6 RevokeBindStatusCallback+0xffb CreateURLMoniker-0x863 urlmon+0x1d1ac @ 0x752fd1ac RevokeBindStatusCallback+0x125a CreateURLMoniker-0x604 urlmon+0x1d40b @ 0x752fd40b RegisterBindStatusCallback+0x2ee7 CopyBindInfo-0x1dd6 urlmon+0x1991b @ 0x752f991b RegisterBindStatusCallback+0x2333 CopyBindInfo-0x298a urlmon+0x18d67 @ 0x752f8d67 RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8 RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85 RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8 DllRegisterServer+0x14b2 msxml3+0x46f4f @ 0x73e76f4f DllRegisterServer+0x13a3 msxml3+0x46e40 @ 0x73e76e40 DllGetClassObject+0x3536b DllCanUnloadNow-0x1017 msxml3+0x427a4 @ 0x73e727a4 DllGetClassObject+0x35219 DllCanUnloadNow-0x1169 msxml3+0x42652 @ 0x73e72652 DllGetClassObject+0x35104 DllCanUnloadNow-0x127e msxml3+0x4253d @ 0x73e7253d DllGetClassObject+0x34fd8 DllCanUnloadNow-0x13aa msxml3+0x42411 @ 0x73e72411 DllGetClassObject+0x35172 DllCanUnloadNow-0x1210 msxml3+0x425ab @ 0x73e725ab wmic+0x39c80 @ 0x579c80 wmic+0x3b06a @ 0x57b06a wmic+0x3b1f8 @ 0x57b1f8 wmic+0x36fcd @ 0x576fcd wmic+0x3d6e9 @ 0x57d6e9 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 2025160 registers.edi: 1974991376 registers.eax: 2025160 registers.ebp: 2025240 registers.edx: 1 registers.ebx: 7204228 registers.esi: 2147746133 registers.ecx: 4186877547	1

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 3, 2025, 9:58 a.m.	process_identifier: 2280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73da1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 9:58 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74031000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 3, 2025, 9:58 a.m.	process_identifier: 2464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73da1000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

EmmetPROD.exe tried to sleep 453 seconds, actually delayed analysis time by 453 seconds

Creates a suspicious process (4 events)

cmdline	wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value
cmdline	wmic computersystem get name, TotalPhysicalMemory /Value
cmdline	wmic os get caption /Value
cmdline	C:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig \| find "IPv4" \| find /N ":" \| find "[1]"

Executes one or more WMI queries (3 events)

wmi	SELECT Name, TotalPhysicalMemory FROM Win32_ComputerSystem
wmi	SELECT CurrentHorizontalResolution, CurrentVerticalResolution FROM Win32_VideoController
wmi	SELECT caption FROM Win32_OperatingSystem

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Feb. 3, 2025, 9:58 a.m.	flags: 198 family: 0		111	0

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	ipconfig
cmdline	wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value
cmdline	wmic computersystem get name, TotalPhysicalMemory /Value
cmdline	wmic os get caption /Value
cmdline	C:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig \| find "IPv4" \| find /N ":" \| find "[1]"

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	SELECT Name, TotalPhysicalMemory FROM Win32_ComputerSystem

Communicates with host for which no DNS query was performed (1 event)

host

141.147.43.219

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW Feb. 3, 2025, 9:58 a.m.	thread_identifier: 0 callback_function: 0x00ca4420 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00ca0000	1	459243	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Lionic	Trojan.Win32.KeyLogger.4!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Ghanarava.1681404907f417f2
Skyhigh	Artemis!Trojan
ALYac	Gen:Variant.Lazy.285270
Cylance	Unsafe
VIPRE	Trojan.GenericKD.75729039
Sangfor	Spyware.Win32.KeyLogger.Vahr
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.GenericKD.75729039
K7GW	Spyware ( 005657801 )
K7AntiVirus	Spyware ( 005657801 )
Arcabit	Trojan.Generic.D483888F
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.KeyLogger.QYN
Avast	Win32:Trojan-gen
Alibaba	TrojanSpy:Win32/KeyLogger.152269c2
MicroWorld-eScan	Trojan.GenericKD.75729039
Rising	Spyware.KeyLogger!8.12F (CLOUD)
Emsisoft	Trojan.GenericKD.75729039 (B)
F-Secure	Trojan.TR/Spy.KeyLogger.jftlf
Zillya	Trojan.Keylogger.Win32.77553
McAfeeD	ti!EBE24F9D635E
CTX	exe.trojan.generic
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Trojan.GenericKD.75729039
Google	Detected
Avira	TR/Spy.KeyLogger.jftlf
Antiy-AVL	Trojan[Spy]/Win32.KeyLogger
Xcitium	Malware@#27vsnd5svvgxt
Microsoft	Trojan:Win32/Casdet!rfn
ViRobot	Trojan.Win.Z.Keylogger.535040
GData	Trojan.GenericKD.75729039
AhnLab-V3	Trojan/Win.Generic.C5435527
McAfee	Artemis!D62A00606FB3
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.4175686135
Ikarus	Trojan-Spy.Win32.KeyLogger
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H0CAT25
Tencent	Win32.Trojan.Spy.Cwnw
MaxSecure	Trojan.Malware.200515874.susgen
Fortinet	W32/KeyLogger.QYN!tr.spy
AVG	Win32:Trojan-gen
Paloalto	generic.ml
alibabacloud	Trojan[spy]:Win/KeyLogger.QNS

EmmetPROD.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All