Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Feb. 25, 2025, 1:21 p.m.	Feb. 25, 2025, 1:26 p.m.

Size	4.2MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`99711400fad366c4e65956fbe17622ec`
SHA256	`19e896996a23e019db80cd71b0b872e1f9ac7378661c1948c15128bfc7250d1c`
CRC32	`7E9F8F69`
ssdeep	`98304:41P+Jjyn60IQLmUiTR6shoVyRquOetcI3s:Y+Jje6HQLtiTRzoV0Rzt/3`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult NorthKorea_Zero - Maybe it's North Korea File Is_DotNET_EXE - (no description) IsPE32 - (no description) UPX_Zero - UPX packed file

update.exe "C:\Users\test22\AppData\Local\Temp\update.exe"
776
- WindowsLib.exe "C:\Users\test22\AppData\Local\Temp\WindowsLib.exe"
  2148

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameA Feb. 25, 2025, 1:21 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 25, 2025, 1:21 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Feb. 25, 2025, 1:21 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 25, 2025, 1:21 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (8 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 25, 2025, 1:21 p.m.			0	0
IsDebuggerPresent Feb. 25, 2025, 1:21 p.m.			0	0
IsDebuggerPresent Feb. 25, 2025, 1:21 p.m.			0	0
IsDebuggerPresent Feb. 25, 2025, 1:21 p.m.			0	0
IsDebuggerPresent Feb. 25, 2025, 1:21 p.m.			0	0
IsDebuggerPresent Feb. 25, 2025, 1:21 p.m.			0	0
IsDebuggerPresent Feb. 25, 2025, 1:21 p.m.			0	0
IsDebuggerPresent Feb. 25, 2025, 1:21 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (10 events)

Time & API	Arguments	Status	Return
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a14a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a14a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a1568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a1568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: f 8ôpãGøÆtæÃÌùþìqP:Yh'ÊÞÅ crypto_handle: 0x004a1568 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a1528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a1528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a15a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004a1528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey Feb. 25, 2025, 1:21 p.m.	buffer: f 8ôpãGøÆtæÃÌùþìqP:Yh'ÊÞÅ crypto_handle: 0x004a1528 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 25, 2025, 1:21 p.m.		1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Feb. 25, 2025, 1:21 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x74111194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73fe2ba1 0x85c7e4 0x857009 mscorlib+0xd3689c @ 0x732f689c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f72e95 CopyPDBs+0x4a96 DllCanUnloadNowInternal-0x3c541 clr+0x19a6d8 @ 0x740fa6d8 CopyPDBs+0x4af5 DllCanUnloadNowInternal-0x3c4e2 clr+0x19a737 @ 0x740fa737 PreBindAssemblyEx+0x7116 StrongNameSignatureVerification-0xae35 clr+0x17ec81 @ 0x740dec81 PreBindAssemblyEx+0x71be StrongNameSignatureVerification-0xad8d clr+0x17ed29 @ 0x740ded29 mscorlib+0x389e52 @ 0x72949e52 mscorlib+0x309c30 @ 0x728c9c30 mscorlib+0x2f809f @ 0x728b809f 0x8e7bbb 0x566f20c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f89df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f89e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f89efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f89fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x740b0f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f7bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f62ae9 0x566f040 0x566e7e9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f89df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f89e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f89efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f89fa2 DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x740b0f4d DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f7bcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f62ae9 0x6704a6 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f89df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f89e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f89efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f89fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x73fe564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x73fbbe63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x73fbb998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x73fbb726 CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x73fbbf68 CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x73fbbce4 DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x73f7cca4 DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x73f7cd37 DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x74068841 LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x73fe14e9 mscorlib+0x2d3711 @ 0x72893711 mscorlib+0x308f2d @ 0x728c8f2d mscorlib+0x3133fd @ 0x728d33fd 0x6703d5 0x67008d 0x670056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f72e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x740274ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74027610 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 2214144 registers.edi: 0 registers.eax: 2214144 registers.ebp: 2214224 registers.edx: 0 registers.ebx: 5148584 registers.esi: 4746216 registers.ecx: 2204753336	1
__exception__ Feb. 25, 2025, 1:21 p.m.	stacktrace: mscorlib+0x983097 @ 0x72f43097 0xa9d66f 0xa9d513 0xa9cafa 0xa9c898 0xa9c0cb 0xa9bf4b 0x6f394f DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73fe1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73fe1737 mscorlib+0x2d3711 @ 0x72893711 mscorlib+0x308f2d @ 0x728c8f2d mscorlib+0x3133fd @ 0x728d33fd 0x6703d5 0x67008d 0x670056 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f72e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x740274ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74027610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x740b1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x740b1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x740b1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x740b416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7460f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74897f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74894de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 eb 3e 8d 55 e0 0f b6 01 88 02 0f b6 41 01 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: mscorlib+0x324f62 exception.address: 0x728e4f62 registers.esp: 2222432 registers.edi: 2222456 registers.eax: 0 registers.ebp: 2222468 registers.edx: 0 registers.ebx: 0 registers.esi: 60 registers.ecx: 60	1
__exception__ Feb. 25, 2025, 1:21 p.m.	stacktrace: exception.instruction_r: 69 6e 2d 63 6f 72 65 2d 70 72 6f 63 65 73 73 74 exception.symbol: InitializeProcThreadAttributeList+0x8 InitializeSListHead-0x40 kernel32+0xc9c4b exception.instruction: imul ebp, dword ptr [esi + 0x2d], 0x65726f63 exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 826443 exception.address: 0x758a9c4b registers.esp: 2221204 registers.edi: 40241550 registers.eax: 2297724587 registers.ebp: 1 registers.edx: 2212243554 registers.ebx: 2221544 registers.esi: 0 registers.ecx: 1945537704	1

Time & API

Arguments

Status

Return

Repeated

__exception__

Feb. 25, 2025, 1:21 p.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x74111194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73fe2ba1
0x85c7e4
0x857009
mscorlib+0xd3689c @ 0x732f689c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f72e95
CopyPDBs+0x4a96 DllCanUnloadNowInternal-0x3c541 clr+0x19a6d8 @ 0x740fa6d8
CopyPDBs+0x4af5 DllCanUnloadNowInternal-0x3c4e2 clr+0x19a737 @ 0x740fa737
PreBindAssemblyEx+0x7116 StrongNameSignatureVerification-0xae35 clr+0x17ec81 @ 0x740dec81
PreBindAssemblyEx+0x71be StrongNameSignatureVerification-0xad8d clr+0x17ed29 @ 0x740ded29
mscorlib+0x389e52 @ 0x72949e52
mscorlib+0x309c30 @ 0x728c9c30
mscorlib+0x2f809f @ 0x728b809f
0x8e7bbb
0x566f20c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f89df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f89e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f89efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f89fa2
DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x740b0f4d
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f7bcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f62ae9
0x566f040
0x566e7e9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f89df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f89e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f89efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f89fa2
DllGetClassObjectInternal+0x8bed4 CorDllMainForThunk-0x627 clr+0x150f4d @ 0x740b0f4d
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x73f7bcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x73f62ae9
0x6704a6
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x73f89df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x73f89e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x73f89efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x73f89fa2
LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x73fe564b
CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x73fbbe63
CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x73fbb998
CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x73fbb726
CreateAssemblyNameObject+0x2eacf GetMetaDataInternalInterface-0x99a0 clr+0x5bf68 @ 0x73fbbf68
CreateAssemblyNameObject+0x2e84b GetMetaDataInternalInterface-0x9c24 clr+0x5bce4 @ 0x73fbbce4
DllRegisterServerInternal+0xa898 CoUninitializeEE-0x2ba0 clr+0x1cca4 @ 0x73f7cca4
DllRegisterServerInternal+0xa92b CoUninitializeEE-0x2b0d clr+0x1cd37 @ 0x73f7cd37
DllGetClassObjectInternal+0x437c8 CorDllMainForThunk-0x48d33 clr+0x108841 @ 0x74068841
LogHelp_TerminateOnAssert+0x129a9 GetPrivateContextsPerfCounters-0x6a99 clr+0x814e9 @ 0x73fe14e9
mscorlib+0x2d3711 @ 0x72893711
mscorlib+0x308f2d @ 0x728c8f2d
mscorlib+0x3133fd @ 0x728d33fd
0x6703d5
0x67008d
0x670056
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f72e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x740274ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74027610

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 2214144
registers.edi: 0
registers.eax: 2214144
registers.ebp: 2214224
registers.edx: 0
registers.ebx: 5148584
registers.esi: 4746216
registers.ecx: 2204753336

__exception__

Feb. 25, 2025, 1:21 p.m.

stacktrace:

mscorlib+0x983097 @ 0x72f43097
0xa9d66f
0xa9d513
0xa9cafa
0xa9c898
0xa9c0cb
0xa9bf4b
0x6f394f
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73fe1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73fe1737
mscorlib+0x2d3711 @ 0x72893711
mscorlib+0x308f2d @ 0x728c8f2d
mscorlib+0x3133fd @ 0x728d33fd
0x6703d5
0x67008d
0x670056
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f7264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f72e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x740274ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74027610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x740b1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x740b1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x740b1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x740b416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7460f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74897f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74894de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 01 eb 3e 8d 55 e0 0f b6 01 88 02 0f b6 41 01
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol: mscorlib+0x324f62
exception.address: 0x728e4f62
registers.esp: 2222432
registers.edi: 2222456
registers.eax: 0
registers.ebp: 2222468
registers.edx: 0
registers.ebx: 0
registers.esi: 60
registers.ecx: 60

__exception__

Feb. 25, 2025, 1:21 p.m.

stacktrace:

exception.instruction_r: 69 6e 2d 63 6f 72 65 2d 70 72 6f 63 65 73 73 74
exception.symbol: InitializeProcThreadAttributeList+0x8 InitializeSListHead-0x40 kernel32+0xc9c4b
exception.instruction: imul ebp, dword ptr [esi + 0x2d], 0x65726f63
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 826443
exception.address: 0x758a9c4b
registers.esp: 2221204
registers.edi: 40241550
registers.eax: 2297724587
registers.ebp: 1
registers.edx: 2212243554
registers.ebx: 2221544
registers.esi: 0
registers.ecx: 1945537704

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 153 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 53248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00671000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0067f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e64000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 86016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05651000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05666000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05669000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0566a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0566b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0566c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0566d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0566e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0566f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00851000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00854000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 25, 2025, 1:21 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FeedbackSize.vbs
file	C:\Users\test22\AppData\Local\Temp\WindowsLib.exe
file	C:\Users\test22\AppData\Roaming\FeedbackSize.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\WindowsLib.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\WindowsLib.exe
file	C:\Users\test22\AppData\Roaming\FeedbackSize.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00436c00', u'virtual_address': u'0x00002000', u'entropy': 7.869180432980214, u'name': u'.text', u'virtual_size': u'0x00436b64'}

entropy

7.86918043298

description

A section with a high entropy has been found

entropy

0.999536715312

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Feb. 25, 2025, 1:21 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Feb. 25, 2025, 1:21 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: bbbc18a5775320fc664bd0b93372fe628d4a0f1c
buffer	Buffer with sha1: 484a570536f40d3c1b82511de7807c427dea19fc
buffer	Buffer with sha1: df745fa68718e89181c4a01d0733571f9659bc61

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FeedbackSize.vbs

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 776	1	0
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 776	1	0
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 776	1	0
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 776	1	0
NtGetContextThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000e8	1	0
NtSetContextThread Feb. 25, 2025, 1:21 p.m.	registers.eip: 1946037124 registers.esp: 2214352 registers.edi: 2215812 registers.eax: 336 registers.ebp: 2215820 registers.edx: 116 registers.ebx: 2216068 registers.esi: 42275616 registers.ecx: 43700760 thread_handle: 0x000000e8 process_identifier: 776	1	0
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 776	1	0
NtGetContextThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000e8	1	0
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 776	1	0
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x0000026c suspend_count: 1 process_identifier: 776	1	0
CreateProcessInternalW Feb. 25, 2025, 1:21 p.m.	thread_identifier: 2152 thread_handle: 0x000003dc process_identifier: 2148 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\WindowsLib.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\WindowsLib.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\WindowsLib.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003e4	1	1
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2148	1	0
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2148	1	0
NtResumeThread Feb. 25, 2025, 1:21 p.m.	thread_handle: 0x000001d8 suspend_count: 1 process_identifier: 2148	1	0

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Gen:Variant.Jalapeno.19774
CTX	exe.trojan.msil
CAT-QuickHeal	Trojan.Ghanarava.17404356607622ec
ALYac	IL:Trojan.MSILZilla.174585
Cylance	Unsafe
K7AntiVirus	Trojan ( 005c25d31 )
Alibaba	Trojan:MSIL/GenKryptik.5a1795db
K7GW	Trojan ( 005c25d31 )
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.ANET
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.Remcos.zmi
BitDefender	Gen:Variant.Jalapeno.19774
Rising	Trojan.Kryptik!8.8 (CLOUD)
Emsisoft	Gen:Variant.Jalapeno.19774 (B)
F-Secure	Trojan.TR/AD.Remcos.yttuq
VIPRE	IL:Trojan.MSILZilla.174585
TrendMicro	Backdoor.Win32.REMCOS.YXFBXZ
McAfeeD	ti!19E896996A23
Trapmine	malicious.high.ml.score
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.99711400fad366c4
Google	Detected
Avira	TR/AD.Remcos.yttuq
Gridinsoft	Trojan.Win32.Kryptik.sa
Arcabit	Trojan.Jalapeno.D4D3E
ViRobot	Trojan.Win.Z.Wacapew.4421120
Microsoft	Trojan:Win32/Wacatac.B!ml
Varist	W32/MSIL_Agent.JPI.gen!Eldorado
AhnLab-V3	Trojan/Win.MSILZilla.C5733193
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL.Generic
Ikarus	Trojan.MSIL.Krypt
TrendMicro-HouseCall	Backdoor.Win32.REMCOS.YXFBXZ
Fortinet	MSIL/Kryptik.ANET!tr
Panda	Trj/Chgt.AD

update.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All