Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 26, 2025, 9:45 a.m.	Feb. 26, 2025, 9:48 a.m.

Size	945.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c2dcb9b4b8438e79d1630034e407e8e2`
SHA256	`e10b26ef3784d1dcfa4d7f15e3b9ba374c9909f48453f927e12d000d414cfdbf`
CRC32	`FE53BC55`
ssdeep	`24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aY2c0:LTvC/MTQYxsWR7aY2c`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
2656
- taskkill.exe taskkill /F /IM firefox.exe /T
  2760
- taskkill.exe taskkill /F /IM chrome.exe /T
  2888
- taskkill.exe taskkill /F /IM msedge.exe /T
  2972
- taskkill.exe taskkill /F /IM opera.exe /T
  3052
- taskkill.exe taskkill /F /IM brave.exe /T
  1384
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  196
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2220
- taskkill.exe taskkill /F /IM firefox.exe /T
  2532
- taskkill.exe taskkill /F /IM chrome.exe /T
  2644
- taskkill.exe taskkill /F /IM msedge.exe /T
  2380
- taskkill.exe taskkill /F /IM opera.exe /T
  2800
- taskkill.exe taskkill /F /IM brave.exe /T
  2988
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  3068
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3056
- taskkill.exe taskkill /F /IM firefox.exe /T
  2240
- taskkill.exe taskkill /F /IM chrome.exe /T
  2372
- taskkill.exe taskkill /F /IM msedge.exe /T
  828
- taskkill.exe taskkill /F /IM opera.exe /T
  2692
- taskkill.exe taskkill /F /IM brave.exe /T
  2740
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2924
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3000
- taskkill.exe taskkill /F /IM firefox.exe /T
  2068
- taskkill.exe taskkill /F /IM chrome.exe /T
  1668
- taskkill.exe taskkill /F /IM msedge.exe /T
  2612
- taskkill.exe taskkill /F /IM opera.exe /T
  1376
- taskkill.exe taskkill /F /IM brave.exe /T
  1304
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  536
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2732
- taskkill.exe taskkill /F /IM firefox.exe /T
  744
- taskkill.exe taskkill /F /IM chrome.exe /T
  2244
- taskkill.exe taskkill /F /IM msedge.exe /T
  2356
- taskkill.exe taskkill /F /IM opera.exe /T
  1320
- taskkill.exe taskkill /F /IM brave.exe /T
  1792
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2880
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3060
- taskkill.exe taskkill /F /IM firefox.exe /T
  2056
- taskkill.exe taskkill /F /IM chrome.exe /T
  2652
- taskkill.exe taskkill /F /IM msedge.exe /T
  544
- taskkill.exe taskkill /F /IM opera.exe /T
  2900
- taskkill.exe taskkill /F /IM brave.exe /T
  2120
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2144
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    884
- taskkill.exe taskkill /F /IM firefox.exe /T
  2132
- taskkill.exe taskkill /F /IM chrome.exe /T
  1064
- taskkill.exe taskkill /F /IM msedge.exe /T
  2400
- taskkill.exe taskkill /F /IM opera.exe /T
  2128
- taskkill.exe taskkill /F /IM brave.exe /T
  2224
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  3040
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    320
- taskkill.exe taskkill /F /IM firefox.exe /T
  3124
- taskkill.exe taskkill /F /IM chrome.exe /T
  3216
- taskkill.exe taskkill /F /IM msedge.exe /T
  3300
- taskkill.exe taskkill /F /IM opera.exe /T
  3380
- taskkill.exe taskkill /F /IM brave.exe /T
  3460
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  3540
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3584
- taskkill.exe taskkill /F /IM firefox.exe /T
  3712
- taskkill.exe taskkill /F /IM chrome.exe /T
  3792
- taskkill.exe taskkill /F /IM msedge.exe /T
  3896
- taskkill.exe taskkill /F /IM opera.exe /T
  3976
- taskkill.exe taskkill /F /IM brave.exe /T
  4056
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  3140
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    1152
- taskkill.exe taskkill /F /IM firefox.exe /T
  1788
- taskkill.exe taskkill /F /IM chrome.exe /T
  3340
- taskkill.exe taskkill /F /IM msedge.exe /T
  3436
- taskkill.exe taskkill /F /IM opera.exe /T
  3516
- taskkill.exe taskkill /F /IM brave.exe /T
  1980
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  3688
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3776
- taskkill.exe taskkill /F /IM firefox.exe /T
  3840
- taskkill.exe taskkill /F /IM chrome.exe /T
  3988
- taskkill.exe taskkill /F /IM msedge.exe /T
  3144
- taskkill.exe taskkill /F /IM opera.exe /T
  3172
- taskkill.exe taskkill /F /IM brave.exe /T
  3136
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  3364
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3400
- taskkill.exe taskkill /F /IM firefox.exe /T
  872
- taskkill.exe taskkill /F /IM chrome.exe /T
  3676
- taskkill.exe taskkill /F /IM msedge.exe /T
  3876
- taskkill.exe taskkill /F /IM opera.exe /T
  3660
- taskkill.exe taskkill /F /IM brave.exe /T
  4032
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  1092
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3288
- taskkill.exe taskkill /F /IM firefox.exe /T
  3392
- taskkill.exe taskkill /F /IM chrome.exe /T
  3440
- taskkill.exe taskkill /F /IM msedge.exe /T
  3784
- taskkill.exe taskkill /F /IM opera.exe /T
  3892
- taskkill.exe taskkill /F /IM brave.exe /T
  3772
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  4020
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3232

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 68 events)

Time & API	Arguments	Status	Return
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:46 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Feb. 26, 2025, 9:47 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (50 out of 84 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 26, 2025, 9:45 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:38 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:39 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:40 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:40 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:40 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:40 a.m.			0	0
IsDebuggerPresent Feb. 26, 2025, 9:40 a.m.			0	0

Command line console output was observed (50 out of 77 events)

Time & API	Arguments	Status	Return
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "firefox.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: SUCCESS: The process with PID 2220 (child process of PID 196) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: SUCCESS: The process with PID 196 (child process of PID 2656) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:45 a.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 3056 (child process of PID 3068) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 3068 (child process of PID 2656) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 3000 (child process of PID 2924) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 2924 (child process of PID 2656) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 2732 (child process of PID 536) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 536 (child process of PID 2656) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 3060 (child process of PID 2880) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 2880 (child process of PID 2656) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 884 (child process of PID 2144) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:46 a.m.	buffer: SUCCESS: The process with PID 2144 (child process of PID 2656) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: SUCCESS: The process with PID 320 (child process of PID 3040) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: SUCCESS: The process with PID 3040 (child process of PID 2656) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: SUCCESS: The process with PID 3584 (child process of PID 3540) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: SUCCESS: The process with PID 3540 (child process of PID 2656) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW Feb. 26, 2025, 9:47 a.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 26, 2025, 9:45 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 95 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 26, 2025, 9:45 a.m.	process_identifier: 2656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003c70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007398d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000030a0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007398d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000028f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007398d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a40000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a40000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007398d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000028b0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007398d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000030a0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007398d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003480000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007398d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 3584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 3584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c5b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 3584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000a80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 3584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c26000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 3584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003080000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 3584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007398d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 1152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (16 events)

Time & API	Arguments	Status	Return
Process32NextW Feb. 26, 2025, 9:45 a.m.	snapshot_handle: 0x000001d8 process_name: mobsync.exe process_identifier: 2280	1	1
Process32NextW Feb. 26, 2025, 9:45 a.m.	snapshot_handle: 0x000001d8 process_name: taskhost.exe process_identifier: 2496	1	1
Process32NextW Feb. 26, 2025, 9:45 a.m.	snapshot_handle: 0x000001d8 process_name: WmiPrvSE.exe process_identifier: 2844	1	1
Process32NextW Feb. 26, 2025, 9:45 a.m.	snapshot_handle: 0x000001ec process_name: firefox.exe process_identifier: 196	1	1
Process32NextW Feb. 26, 2025, 9:45 a.m.	snapshot_handle: 0x000001d8 process_name: svchost.exe process_identifier: 2352	1	1
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x000001ec process_name: firefox.exe process_identifier: 2924	1	1
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000220 process_name: firefox.exe process_identifier: 536	1	1
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000220 process_name: firefox.exe process_identifier: 2880	1	1
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000220 process_name: firefox.exe process_identifier: 2144	1	1
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000224 process_name: taskhost.exe process_identifier: 2408	1	1
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000178 process_name: firefox.exe process_identifier: 3540	1	1
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000178 process_name: firefox.exe process_identifier: 3140	1	1
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000178 process_name: firefox.exe process_identifier: 3688	1	1
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000178 process_name: firefox.exe process_identifier: 3364	1	1
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000178 process_name: firefox.exe process_identifier: 1092	1	1
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000178 process_name: firefox.exe process_identifier: 4020	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00015c00', u'virtual_address': u'0x000d4000', u'entropy': 7.145421915037016, u'name': u'.rsrc', u'virtual_size': u'0x00015ba8'}

entropy

7.14542191504

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (50 out of 65 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:46 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Feb. 26, 2025, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (12 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Feb. 26, 2025, 9:45 a.m.	snapshot_handle: 0x000001d8 process_name: svchost.exe process_identifier: 2352		0	0
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x000001d8 process_name: svchost.exe process_identifier: 2352		0	0
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000224 process_name: svchost.exe process_identifier: 2352		0	0
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000224 process_name: svchost.exe process_identifier: 2352		0	0
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000224 process_name: svchost.exe process_identifier: 2352		0	0
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000224 process_name: taskhost.exe process_identifier: 2408		0	0
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000204 process_name: taskhost.exe process_identifier: 2408		0	0
Process32NextW Feb. 26, 2025, 9:46 a.m.	snapshot_handle: 0x00000204 process_name: taskhost.exe process_identifier: 2408		0	0
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000204 process_name: taskhost.exe process_identifier: 2408		0	0
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000204 process_name: taskhost.exe process_identifier: 2408		0	0
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000204 process_name: taskhost.exe process_identifier: 2408		0	0
Process32NextW Feb. 26, 2025, 9:47 a.m.	snapshot_handle: 0x00000204 process_name: taskhost.exe process_identifier: 2408		0	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml
url	https://crash-reports.mozilla.com/submit?id=
url	https://hg.mozilla.org/releases/mozilla-release/rev/92187d03adde4b31daef292087a266f10121379c

Yara rule detected in process memory (50 out of 117 events)

description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active

Terminates another process (48 events)

Time & API	Arguments	Status
NtTerminateProcess Feb. 26, 2025, 9:45 a.m.	status_code: 0x00000001 process_identifier: 2220 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:45 a.m.	status_code: 0x00000001 process_identifier: 2220 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:45 a.m.	status_code: 0x00000001 process_identifier: 196 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:45 a.m.	status_code: 0x00000001 process_identifier: 196 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 3056 process_handle: 0x00000190
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 3056 process_handle: 0x00000190	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 3068 process_handle: 0x00000190
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 3068 process_handle: 0x00000190	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 3000 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 3000 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 2924 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 2924 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 2732 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 2732 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 536 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 536 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 3060 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 3060 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 2880 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 2880 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 884 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 884 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 2144 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:46 a.m.	status_code: 0x00000001 process_identifier: 2144 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 320 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 320 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3040 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3040 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3584 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3584 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3540 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3540 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 1152 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 1152 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3140 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3140 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3776 process_handle: 0x00000194
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3776 process_handle: 0x00000194	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3688 process_handle: 0x00000194
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3688 process_handle: 0x00000194	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3400 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3400 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3364 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3364 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3288 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 3288 process_handle: 0x0000018c	1
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 1092 process_handle: 0x0000018c
NtTerminateProcess Feb. 26, 2025, 9:47 a.m.	status_code: 0x00000001 process_identifier: 1092 process_handle: 0x0000018c	1

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	taskkill /F /IM opera.exe /T
cmdline	taskkill /F /IM chrome.exe /T
cmdline	taskkill /F /IM msedge.exe /T
cmdline	taskkill /F /IM firefox.exe /T
cmdline	taskkill /F /IM brave.exe /T

Allocates execute permission to another process indicative of possible code injection (26 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 2220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:38 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 3060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:39 a.m.	process_identifier: 320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 3584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 3584 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 1152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:40 a.m.	process_identifier: 1152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:47 a.m.	process_identifier: 3776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:47 a.m.	process_identifier: 3776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:47 a.m.	process_identifier: 3400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:47 a.m.	process_identifier: 3400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:47 a.m.	process_identifier: 3288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:47 a.m.	process_identifier: 3288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:47 a.m.	process_identifier: 3232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory Feb. 26, 2025, 9:47 a.m.	process_identifier: 3232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d57000 process_handle: 0x0000000000000050	1

Potential code injection by writing to the memory of another process (50 out of 117 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: base_address: 0x000000013ff422b0 process_identifier: 2220 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: base_address: 0x000000013ff50d88 process_identifier: 2220 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: I»`#ñ?Aÿã base_address: 0x0000000076d81590 process_identifier: 2220 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: ¸ base_address: 0x000000013ff50d78 process_identifier: 2220 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: I» ñ?Aÿã base_address: 0x0000000076d57a90 process_identifier: 2220 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: ¸ base_address: 0x000000013ff50d70 process_identifier: 2220 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: ÏT base_address: 0x000000013fef0108 process_identifier: 2220 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: Øv@Øv Øv@ØvØv°Øv ÕvàTÕv 3ØvØvÀ´Óv`,ØvÀÖvöÔv YØv2ØvVØv°ÞvÕvRØv ÕvQØvÂÕv ?ÖvPÕv°TÕvàtÕvðÖvÐ1ØvÔvÐOÔv`ê×vÐæ×vÐæ×vÐ.Øv base_address: 0x000000013ff4aae8 process_identifier: 2220 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: base_address: 0x000000013ff50c78 process_identifier: 2220 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: base_address: 0x000000013f5e22b0 process_identifier: 3056 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: base_address: 0x000000013f5f0d88 process_identifier: 3056 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: I»`#[?Aÿã base_address: 0x0000000076d81590 process_identifier: 3056 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: Ö base_address: 0x000000013f5f0d78 process_identifier: 3056 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: I» [?Aÿã base_address: 0x0000000076d57a90 process_identifier: 3056 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: Ö base_address: 0x000000013f5f0d70 process_identifier: 3056 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: ÏT base_address: 0x000000013f590108 process_identifier: 3056 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: Øv@Øv Øv@ØvØv°Øv ÕvàTÕv 3ØvØvÀ´Óv`,ØvÀÖvöÔv YØv2ØvVØv°ÞvÕvRØv ÕvQØvÂÕv ?ÖvPÕv°TÕvàtÕvðÖvÐ1ØvÔvÐOÔv`ê×vÐæ×vÐæ×vÐ.Øv base_address: 0x000000013f5eaae8 process_identifier: 3056 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:38 a.m.	buffer: base_address: 0x000000013f5f0c78 process_identifier: 3056 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013f4022b0 process_identifier: 3000 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013f410d88 process_identifier: 3000 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: I»`#=?Aÿã base_address: 0x0000000076d81590 process_identifier: 3000 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: «< base_address: 0x000000013f410d78 process_identifier: 3000 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: I» =?Aÿã base_address: 0x0000000076d57a90 process_identifier: 3000 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: «< base_address: 0x000000013f410d70 process_identifier: 3000 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: ÏT base_address: 0x000000013f3b0108 process_identifier: 3000 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: Øv@Øv Øv@ØvØv°Øv ÕvàTÕv 3ØvØvÀ´Óv`,ØvÀÖvöÔv YØv2ØvVØv°ÞvÕvRØv ÕvQØvÂÕv ?ÖvPÕv°TÕvàtÕvðÖvÐ1ØvÔvÐOÔv`ê×vÐæ×vÐæ×vÐ.Øv base_address: 0x000000013f40aae8 process_identifier: 3000 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013f410c78 process_identifier: 3000 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013f3222b0 process_identifier: 2732 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013f330d88 process_identifier: 2732 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: I»`#/?Aÿã base_address: 0x0000000076d81590 process_identifier: 2732 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: # base_address: 0x000000013f330d78 process_identifier: 2732 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: I» /?Aÿã base_address: 0x0000000076d57a90 process_identifier: 2732 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: # base_address: 0x000000013f330d70 process_identifier: 2732 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: ÏT base_address: 0x000000013f2d0108 process_identifier: 2732 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: Øv@Øv Øv@ØvØv°Øv ÕvàTÕv 3ØvØvÀ´Óv`,ØvÀÖvöÔv YØv2ØvVØv°ÞvÕvRØv ÕvQØvÂÕv ?ÖvPÕv°TÕvàtÕvðÖvÐ1ØvÔvÐOÔv`ê×vÐæ×vÐæ×vÐ.Øv base_address: 0x000000013f32aae8 process_identifier: 2732 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013f330c78 process_identifier: 2732 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013fbe22b0 process_identifier: 3060 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013fbf0d88 process_identifier: 3060 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: I»`#»?Aÿã base_address: 0x0000000076d81590 process_identifier: 3060 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: ;C base_address: 0x000000013fbf0d78 process_identifier: 3060 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: I» »?Aÿã base_address: 0x0000000076d57a90 process_identifier: 3060 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: ;C base_address: 0x000000013fbf0d70 process_identifier: 3060 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: ÏT base_address: 0x000000013fb90108 process_identifier: 3060 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: Øv@Øv Øv@ØvØv°Øv ÕvàTÕv 3ØvØvÀ´Óv`,ØvÀÖvöÔv YØv2ØvVØv°ÞvÕvRØv ÕvQØvÂÕv ?ÖvPÕv°TÕvàtÕvðÖvÐ1ØvÔvÐOÔv`ê×vÐæ×vÐæ×vÐ.Øv base_address: 0x000000013fbeaae8 process_identifier: 3060 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013fbf0c78 process_identifier: 3060 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013f3722b0 process_identifier: 884 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: base_address: 0x000000013f380d88 process_identifier: 884 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: I»`#4?Aÿã base_address: 0x0000000076d81590 process_identifier: 884 process_handle: 0x0000000000000050	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: 6% base_address: 0x000000013f380d78 process_identifier: 884 process_handle: 0x000000000000004c	1	1
WriteProcessMemory Feb. 26, 2025, 9:39 a.m.	buffer: I» 4?Aÿã base_address: 0x0000000076d57a90 process_identifier: 884 process_handle: 0x0000000000000050	1	1

Expresses interest in specific running processes (1 event)

process: potential browser injection target

firefox.exe

One or more non-whitelisted processes were created (13 events)

parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

Appends a known multi-family ransomware file extension to files that have been encrypted (2 events)

file	C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\qxo5wa6x.default-release\parent.lock
file	C:\Users\test22\AppData\Local\Temp\firefox\parent.lock

Resumed a suspended thread in a remote process potentially indicative of process injection (26 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 196 resumed a thread in remote process 2220
Process injection	Process 3068 resumed a thread in remote process 3056
Process injection	Process 2924 resumed a thread in remote process 3000
Process injection	Process 536 resumed a thread in remote process 2732
Process injection	Process 2880 resumed a thread in remote process 3060
Process injection	Process 2144 resumed a thread in remote process 884
Process injection	Process 3040 resumed a thread in remote process 320
Process injection	Process 3540 resumed a thread in remote process 3584
Process injection	Process 3140 resumed a thread in remote process 1152
Process injection	Process 3688 resumed a thread in remote process 3776
Process injection	Process 3364 resumed a thread in remote process 3400
Process injection	Process 1092 resumed a thread in remote process 3288
Process injection	Process 4020 resumed a thread in remote process 3232
NtResumeThread Feb. 26, 2025, 9:38 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2220	1	0	0
NtResumeThread Feb. 26, 2025, 9:38 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3056	1	0	0
NtResumeThread Feb. 26, 2025, 9:39 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3000	1	0	0
NtResumeThread Feb. 26, 2025, 9:39 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2732	1	0	0
NtResumeThread Feb. 26, 2025, 9:39 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3060	1	0	0
NtResumeThread Feb. 26, 2025, 9:39 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 884	1	0	0
NtResumeThread Feb. 26, 2025, 9:39 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 320	1	0	0
NtResumeThread Feb. 26, 2025, 9:40 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3584	1	0	0
NtResumeThread Feb. 26, 2025, 9:40 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 1152	1	0	0
NtResumeThread Feb. 26, 2025, 9:47 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3776	1	0	0
NtResumeThread Feb. 26, 2025, 9:47 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3400	1	0	0
NtResumeThread Feb. 26, 2025, 9:47 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3288	1	0	0
NtResumeThread Feb. 26, 2025, 9:47 a.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3232	1	0	0

File has been identified by 21 AntiVirus engines on VirusTotal as malicious (21 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.Win32.Formbook.dh
Cylance	Unsafe
Sangfor	Virus.Win32.Save.a
VirIT	Trojan.Win32.AutoIt_Heur.L
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/HackTool.Silentall.N potentially unsafe
APEX	Malicious
Rising	HackTool.Silentall/Autoit!1.106C3 (CLASSIC)
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	Trojan.Siggen30.17208
McAfeeD	ti!E10B26EF3784
FireEye	Generic.mg.c2dcb9b4b8438e79
Google	Detected
Avira	TR/ATRAPS.Gen
Microsoft	Program:Win32/Wacapew.C!ml
Varist	W32/AutoIt.AEG.gen!Eldorado
Ikarus	PUA.HackTool.Silentall
huorong	TrojanDownloader/AutoIT.Agent.d
Fortinet	Riskware/Silentall

Executed a process and injected code into it, probably while unpacking (50 out of 261 events)

Time & API	Arguments	Status	Return
NtResumeThread Feb. 26, 2025, 9:45 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2656	1	0
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 2764 thread_handle: 0x000001ec process_identifier: 2760 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 2892 thread_handle: 0x000001d8 process_identifier: 2888 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 2976 thread_handle: 0x000001ec process_identifier: 2972 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 3056 thread_handle: 0x000001d8 process_identifier: 3052 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 1404 thread_handle: 0x000001ec process_identifier: 1384 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 148 thread_handle: 0x000001d8 process_identifier: 196 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 2512 thread_handle: 0x000001ec process_identifier: 2532 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 2696 thread_handle: 0x000001d8 process_identifier: 2644 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 2396 thread_handle: 0x000001ec process_identifier: 2380 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 2884 thread_handle: 0x000001d8 process_identifier: 2800 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 2984 thread_handle: 0x000001ec process_identifier: 2988 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:45 a.m.	thread_identifier: 604 thread_handle: 0x000001d8 process_identifier: 3068 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2272 thread_handle: 0x000001ec process_identifier: 2240 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2432 thread_handle: 0x000001d8 process_identifier: 2372 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1656 thread_handle: 0x000001ec process_identifier: 828 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2704 thread_handle: 0x000001d8 process_identifier: 2692 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2796 thread_handle: 0x000001ec process_identifier: 2740 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2992 thread_handle: 0x000001d8 process_identifier: 2924 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001ec	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1976 thread_handle: 0x000001ec process_identifier: 2068 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d8	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 740 thread_handle: 0x00000224 process_identifier: 1668 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 452 thread_handle: 0x00000220 process_identifier: 2612 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1364 thread_handle: 0x00000224 process_identifier: 1376 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 544 thread_handle: 0x00000220 process_identifier: 1304 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1528 thread_handle: 0x00000224 process_identifier: 536 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3040 thread_handle: 0x00000220 process_identifier: 744 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2080 thread_handle: 0x00000224 process_identifier: 2244 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2444 thread_handle: 0x00000220 process_identifier: 2356 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2228 thread_handle: 0x00000224 process_identifier: 1320 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1656 thread_handle: 0x00000220 process_identifier: 1792 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2828 thread_handle: 0x00000224 process_identifier: 2880 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2488 thread_handle: 0x00000220 process_identifier: 2056 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2224 thread_handle: 0x00000224 process_identifier: 2652 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1520 thread_handle: 0x00000220 process_identifier: 544 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1528 thread_handle: 0x00000224 process_identifier: 2900 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1728 thread_handle: 0x00000220 process_identifier: 2120 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3012 thread_handle: 0x00000224 process_identifier: 2144 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2492 thread_handle: 0x00000220 process_identifier: 2132 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1364 thread_handle: 0x00000224 process_identifier: 1064 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 1656 thread_handle: 0x00000220 process_identifier: 2400 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2136 thread_handle: 0x00000224 process_identifier: 2128 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2764 thread_handle: 0x00000220 process_identifier: 2224 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000224	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 2396 thread_handle: 0x00000224 process_identifier: 3040 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000220	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3128 thread_handle: 0x00000178 process_identifier: 3124 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000204	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3220 thread_handle: 0x00000204 process_identifier: 3216 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000178	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3304 thread_handle: 0x00000178 process_identifier: 3300 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000204	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3384 thread_handle: 0x00000204 process_identifier: 3380 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000178	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3464 thread_handle: 0x00000178 process_identifier: 3460 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000204	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3544 thread_handle: 0x00000204 process_identifier: 3540 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000178	1	1
CreateProcessInternalW Feb. 26, 2025, 9:46 a.m.	thread_identifier: 3716 thread_handle: 0x00000178 process_identifier: 3712 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000204	1	1

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All