Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 3, 2025, 4:35 p.m.	May 3, 2025, 4:38 p.m.

Size	950.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`648796e2ffded6ceb4acfcb29ea952ee`
SHA256	`c75595a1eef552c72d18f84a31b30084179f7b1f2e8fa5fa930421d475b5e5ab`
CRC32	`E6BDE3F4`
ssdeep	`24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8aKoP:dTvC/MTQYxsWR7aKo`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
1044
- taskkill.exe taskkill /F /IM firefox.exe /T
  2128
- taskkill.exe taskkill /F /IM chrome.exe /T
  2284
- taskkill.exe taskkill /F /IM msedge.exe /T
  2368
- taskkill.exe taskkill /F /IM opera.exe /T
  2448
- taskkill.exe taskkill /F /IM brave.exe /T
  2528
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2608
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2652
- taskkill.exe taskkill /F /IM firefox.exe /T
  2820
- taskkill.exe taskkill /F /IM chrome.exe /T
  2144
- taskkill.exe taskkill /F /IM msedge.exe /T
  2188
- taskkill.exe taskkill /F /IM opera.exe /T
  2344
- taskkill.exe taskkill /F /IM brave.exe /T
  2468
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2556
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2620
- taskkill.exe taskkill /F /IM firefox.exe /T
  2896
- taskkill.exe taskkill /F /IM chrome.exe /T
  2796
- taskkill.exe taskkill /F /IM msedge.exe /T
  2176
- taskkill.exe taskkill /F /IM opera.exe /T
  2348
- taskkill.exe taskkill /F /IM brave.exe /T
  2340
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2596
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2696
- taskkill.exe taskkill /F /IM firefox.exe /T
  2884
- taskkill.exe taskkill /F /IM chrome.exe /T
  516
- taskkill.exe taskkill /F /IM msedge.exe /T
  1156
- taskkill.exe taskkill /F /IM opera.exe /T
  2460
- taskkill.exe taskkill /F /IM brave.exe /T
  2744
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2920
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2200
- taskkill.exe taskkill /F /IM firefox.exe /T
  2504
- taskkill.exe taskkill /F /IM chrome.exe /T
  1284
- taskkill.exe taskkill /F /IM msedge.exe /T
  288
- taskkill.exe taskkill /F /IM opera.exe /T
  2408
- taskkill.exe taskkill /F /IM brave.exe /T
  2680
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2740
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2912
- taskkill.exe taskkill /F /IM firefox.exe /T
  2124
- taskkill.exe taskkill /F /IM chrome.exe /T
  2280
- taskkill.exe taskkill /F /IM msedge.exe /T
  2948
- taskkill.exe taskkill /F /IM opera.exe /T
  2792
- taskkill.exe taskkill /F /IM brave.exe /T
  2888
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2720
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2276
- taskkill.exe taskkill /F /IM firefox.exe /T
  2716
- taskkill.exe taskkill /F /IM chrome.exe /T
  792
- taskkill.exe taskkill /F /IM msedge.exe /T
  2928
- taskkill.exe taskkill /F /IM opera.exe /T
  2516
- taskkill.exe taskkill /F /IM brave.exe /T
  1076
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  1868
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    2540
- taskkill.exe taskkill /F /IM firefox.exe /T
  2400
- taskkill.exe taskkill /F /IM chrome.exe /T
  3036
- taskkill.exe taskkill /F /IM msedge.exe /T
  2024
- taskkill.exe taskkill /F /IM opera.exe /T
  916
- taskkill.exe taskkill /F /IM brave.exe /T
  1340
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  3088
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3132
- taskkill.exe taskkill /F /IM firefox.exe /T
  3220
- taskkill.exe taskkill /F /IM chrome.exe /T
  3304
- taskkill.exe taskkill /F /IM msedge.exe /T
  3396
- taskkill.exe taskkill /F /IM opera.exe /T
  3476
- taskkill.exe taskkill /F /IM brave.exe /T
  3556
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  3636
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3680
- taskkill.exe taskkill /F /IM firefox.exe /T
  3816
- taskkill.exe taskkill /F /IM chrome.exe /T
  3900
- taskkill.exe taskkill /F /IM msedge.exe /T
  3980
- taskkill.exe taskkill /F /IM opera.exe /T
  4060
- taskkill.exe taskkill /F /IM brave.exe /T
  3116
- firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
  2168
  - firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
    3200
- taskkill.exe taskkill /F /IM firefox.exe /T
  3324
- taskkill.exe taskkill /F /IM chrome.exe /T
  3460

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 55 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 3, 2025, 4:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:35 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:36 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2025, 4:37 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (50 out of 75 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 3, 2025, 4:35 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:36 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:37 p.m.			0	0

Command line console output was observed (50 out of 62 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 3, 2025, 4:35 p.m.	buffer: ERROR: The process "firefox.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2652 (child process of PID 2608) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2608 (child process of PID 1044) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2620 (child process of PID 2556) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2556 (child process of PID 1044) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2696 (child process of PID 2596) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2596 (child process of PID 1044) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2200 (child process of PID 2920) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2920 (child process of PID 1044) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2912 (child process of PID 2740) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: SUCCESS: The process with PID 2740 (child process of PID 1044) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:36 p.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: SUCCESS: The process with PID 2276 (child process of PID 2720) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: SUCCESS: The process with PID 2720 (child process of PID 1044) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: SUCCESS: The process with PID 2540 (child process of PID 1868) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: SUCCESS: The process with PID 1868 (child process of PID 1044) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "msedge.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "opera.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "brave.exe" not found. console_handle: 0x0000000b	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: SUCCESS: The process with PID 3132 (child process of PID 3088) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: SUCCESS: The process with PID 3088 (child process of PID 1044) has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW May 3, 2025, 4:37 p.m.	buffer: ERROR: The process "chrome.exe" not found. console_handle: 0x0000000b	1	1

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 3, 2025, 4:35 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: 0xcd1f04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 69 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xcd1f04 registers.r14: 9236872 registers.r15: 139433584 registers.rcx: 48 registers.rsi: 139365248 registers.r10: 0 registers.rbx: 0 registers.rsp: 9236504 registers.r11: 9239888 registers.r8: 2004779404 registers.r9: 0 registers.rdx: 8796092887632 registers.r12: 14915136 registers.rbp: 9236624 registers.rdi: 372354368 registers.rax: 13442816 registers.r13: 9237464	1	0	0
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: 0xcd1f04 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 69 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xcd1f04 registers.r14: 10547896 registers.r15: 8791424669296 registers.rcx: 48 registers.rsi: 8791424600960 registers.r10: 0 registers.rbx: 0 registers.rsp: 10547528 registers.r11: 10550912 registers.r8: 2004779404 registers.r9: 0 registers.rdx: 8796092887632 registers.r12: 14906704 registers.rbp: 10547648 registers.rdi: 209821728 registers.rax: 13442816 registers.r13: 10548488	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 92 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000030e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000749ad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000028e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000749ad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 85934080 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003161000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 15130624 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000008355000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2252800 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000009313000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000009539000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000953a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000953b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000a399000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 765952 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000a39c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000026c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000749ad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b50000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b50000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000027c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000749ad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 85934080 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000031d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 15130624 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000083c5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2252800 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000009383000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000095a9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000095aa000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000095ab000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000a409000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 765952 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000a40c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000028f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000749ad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007700b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd6000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (4 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process firefox.exe with pid 2540 crashed
Application Crash	Process firefox.exe with pid 3200 crashed
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: 0xcd1f04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 69 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xcd1f04 registers.r14: 9236872 registers.r15: 139433584 registers.rcx: 48 registers.rsi: 139365248 registers.r10: 0 registers.rbx: 0 registers.rsp: 9236504 registers.r11: 9239888 registers.r8: 2004779404 registers.r9: 0 registers.rdx: 8796092887632 registers.r12: 14915136 registers.rbp: 9236624 registers.rdi: 372354368 registers.rax: 13442816 registers.r13: 9237464	1	0	0
__exception__ May 3, 2025, 4:37 p.m.	stacktrace: 0xcd1f04 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 0x7fe00000030 exception.instruction_r: 83 3d 8d d1 02 00 00 ff 25 00 00 00 00 53 12 69 exception.instruction: cmp dword ptr [rip + 0x2d18d], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xcd1f04 registers.r14: 10547896 registers.r15: 8791424669296 registers.rcx: 48 registers.rsi: 8791424600960 registers.r10: 0 registers.rbx: 0 registers.rsp: 10547528 registers.r11: 10550912 registers.r8: 2004779404 registers.r9: 0 registers.rdx: 8796092887632 registers.r12: 14906704 registers.rbp: 10547648 registers.rdi: 209821728 registers.rax: 13442816 registers.r13: 10548488	1	0	0

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (27 events)

Time & API	Arguments	Status	Return
Process32NextW May 3, 2025, 4:35 p.m.	snapshot_handle: 0x000001d0 process_name: pw.exe process_identifier: 1904	1	1
Process32NextW May 3, 2025, 4:35 p.m.	snapshot_handle: 0x000001d0 process_name: taskhost.exe process_identifier: 2040	1	1
Process32NextW May 3, 2025, 4:35 p.m.	snapshot_handle: 0x000001d0 process_name: SearchProtocolHost.exe process_identifier: 1720	1	1
Process32NextW May 3, 2025, 4:35 p.m.	snapshot_handle: 0x000001d0 process_name: conhost.exe process_identifier: 1492	1	1
Process32NextW May 3, 2025, 4:35 p.m.	snapshot_handle: 0x000001d0 process_name: SearchFilterHost.exe process_identifier: 808	1	1
Process32NextW May 3, 2025, 4:35 p.m.	snapshot_handle: 0x000001d0 process_name: random.exe process_identifier: 1044	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x000001e4 process_name: firefox.exe process_identifier: 2608	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x000001d0 process_name: mscorsvw.exe process_identifier: 2980	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x000001d0 process_name: sppsvc.exe process_identifier: 1740	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x000001e4 process_name: firefox.exe process_identifier: 2596	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x0000021c process_name: cmd.exe process_identifier: 1608	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x0000021c process_name: pw.exe process_identifier: 2932	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x00000218 process_name: firefox.exe process_identifier: 2920	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x0000021c process_name: cmd.exe process_identifier: 1228	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x0000021c process_name: conhost.exe process_identifier: 2648	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x0000021c process_name: pw.exe process_identifier: 2400	1	1
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x00000170 process_name: firefox.exe process_identifier: 2720	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x00000170 process_name: firefox.exe process_identifier: 1868	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: cmd.exe process_identifier: 2844	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: conhost.exe process_identifier: 932	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: pw.exe process_identifier: 2004	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x00000170 process_name: firefox.exe process_identifier: 3088	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x00000170 process_name: firefox.exe process_identifier: 3636	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: cmd.exe process_identifier: 3768	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: conhost.exe process_identifier: 3776	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: pw.exe process_identifier: 3800	1	1
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x00000170 process_name: firefox.exe process_identifier: 2168	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00000000027c0000 process_handle: 0xffffffffffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00017000', u'virtual_address': u'0x000d4000', u'entropy': 7.2108141687092955, u'name': u'.rsrc', u'virtual_size': u'0x00016fb0'}

entropy

7.21081416871

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (50 out of 52 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 3, 2025, 4:35 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:36 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 3, 2025, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (9 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x000001d0 process_name: sppsvc.exe process_identifier: 1740		0	0
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x000001d0 process_name: sppsvc.exe process_identifier: 1740		0	0
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x0000021c process_name: pw.exe process_identifier: 2932		0	0
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x0000021c process_name: sppsvc.exe process_identifier: 1740		0	0
Process32NextW May 3, 2025, 4:36 p.m.	snapshot_handle: 0x0000021c process_name: pw.exe process_identifier: 2400		0	0
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: sppsvc.exe process_identifier: 1740		0	0
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: pw.exe process_identifier: 2004		0	0
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: sppsvc.exe process_identifier: 1740		0	0
Process32NextW May 3, 2025, 4:37 p.m.	snapshot_handle: 0x0000021c process_name: pw.exe process_identifier: 3800		0	0

Potentially malicious URLs were found in the process memory dump (3 events)

url	https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml
url	https://crash-reports.mozilla.com/submit?id=
url	https://hg.mozilla.org/releases/mozilla-release/rev/92187d03adde4b31daef292087a266f10121379c

Yara rule detected in process memory (50 out of 90 events)

description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active

Terminates another process (40 events)

Time & API	Arguments	Status
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2652 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2652 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2608 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2608 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2620 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2620 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2556 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2556 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2696 process_handle: 0x0000018c
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2696 process_handle: 0x0000018c	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2596 process_handle: 0x0000018c
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2596 process_handle: 0x0000018c	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2200 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2200 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2920 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2920 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2912 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2912 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2740 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:36 p.m.	status_code: 0x00000001 process_identifier: 2740 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 2276 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 2276 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 2720 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 2720 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 2540 process_handle: 0x0000018c
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 2540 process_handle: 0x0000018c	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 1868 process_handle: 0x0000018c
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 1868 process_handle: 0x0000018c	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3132 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3132 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3088 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3088 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3680 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3680 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3636 process_handle: 0x00000188
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3636 process_handle: 0x00000188	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3200 process_handle: 0x0000018c
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 3200 process_handle: 0x0000018c	1
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 2168 process_handle: 0x0000018c
NtTerminateProcess May 3, 2025, 4:37 p.m.	status_code: 0x00000001 process_identifier: 2168 process_handle: 0x0000018c	1

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	taskkill /F /IM opera.exe /T
cmdline	taskkill /F /IM chrome.exe /T
cmdline	taskkill /F /IM msedge.exe /T
cmdline	taskkill /F /IM firefox.exe /T
cmdline	taskkill /F /IM brave.exe /T

Allocates execute permission to another process indicative of possible code injection (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:36 p.m.	process_identifier: 2276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 3132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 3132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 3680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 3680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 3200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0x0000000000000050	1
NtProtectVirtualMemory May 3, 2025, 4:37 p.m.	process_identifier: 3200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776e7000 process_handle: 0x0000000000000050	1

Potential code injection by writing to the memory of another process (50 out of 90 events)

Time & API	Arguments	Status	Return
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013fb822b0 process_identifier: 2652 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013fb90d88 process_identifier: 2652 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I»`#µ?Aÿã base_address: 0x0000000077711590 process_identifier: 2652 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ; base_address: 0x000000013fb90d78 process_identifier: 2652 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I» µ?Aÿã base_address: 0x00000000776e7a90 process_identifier: 2652 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ; base_address: 0x000000013fb90d70 process_identifier: 2652 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ÏT base_address: 0x000000013fb30108 process_identifier: 2652 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: qw@qw qw@qwqw°qw nwàTnw 3qwqwÀ´lw`,qwÀowömw Yqw2qwVqw°wwnwRqw nwQqwÂnw ?owPnw°TnwàtnwðowÐ1qwmwÐOmw`êpwÐæpwÐæpwÐ.qw base_address: 0x000000013fb8aae8 process_identifier: 2652 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013fb90c78 process_identifier: 2652 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013f7722b0 process_identifier: 2620 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013f780d88 process_identifier: 2620 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I»`#t?Aÿã base_address: 0x0000000077711590 process_identifier: 2620 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: C base_address: 0x000000013f780d78 process_identifier: 2620 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I» t?Aÿã base_address: 0x00000000776e7a90 process_identifier: 2620 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: C base_address: 0x000000013f780d70 process_identifier: 2620 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ÏT base_address: 0x000000013f720108 process_identifier: 2620 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: qw@qw qw@qwqw°qw nwàTnw 3qwqwÀ´lw`,qwÀowömw Yqw2qwVqw°wwnwRqw nwQqwÂnw ?owPnw°TnwàtnwðowÐ1qwmwÐOmw`êpwÐæpwÐæpwÐ.qw base_address: 0x000000013f77aae8 process_identifier: 2620 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013f780c78 process_identifier: 2620 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013f4a22b0 process_identifier: 2696 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013f4b0d88 process_identifier: 2696 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I»`#G?Aÿã base_address: 0x0000000077711590 process_identifier: 2696 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: Ï= base_address: 0x000000013f4b0d78 process_identifier: 2696 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I» G?Aÿã base_address: 0x00000000776e7a90 process_identifier: 2696 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: Ï= base_address: 0x000000013f4b0d70 process_identifier: 2696 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ÏT base_address: 0x000000013f450108 process_identifier: 2696 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: qw@qw qw@qwqw°qw nwàTnw 3qwqwÀ´lw`,qwÀowömw Yqw2qwVqw°wwnwRqw nwQqwÂnw ?owPnw°TnwàtnwðowÐ1qwmwÐOmw`êpwÐæpwÐæpwÐ.qw base_address: 0x000000013f4aaae8 process_identifier: 2696 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013f4b0c78 process_identifier: 2696 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x00000001400422b0 process_identifier: 2200 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x0000000140050d88 process_identifier: 2200 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I»`#@Aÿã base_address: 0x0000000077711590 process_identifier: 2200 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ¼{ base_address: 0x0000000140050d78 process_identifier: 2200 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I» @Aÿã base_address: 0x00000000776e7a90 process_identifier: 2200 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ¼{ base_address: 0x0000000140050d70 process_identifier: 2200 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ÏT base_address: 0x000000013fff0108 process_identifier: 2200 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: qw@qw qw@qwqw°qw nwàTnw 3qwqwÀ´lw`,qwÀowömw Yqw2qwVqw°wwnwRqw nwQqwÂnw ?owPnw°TnwàtnwðowÐ1qwmwÐOmw`êpwÐæpwÐæpwÐ.qw base_address: 0x000000014004aae8 process_identifier: 2200 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x0000000140050c78 process_identifier: 2200 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013faf22b0 process_identifier: 2912 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013fb00d88 process_identifier: 2912 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I»`#¬?Aÿã base_address: 0x0000000077711590 process_identifier: 2912 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: U base_address: 0x000000013fb00d78 process_identifier: 2912 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I» ¬?Aÿã base_address: 0x00000000776e7a90 process_identifier: 2912 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: U base_address: 0x000000013fb00d70 process_identifier: 2912 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ÏT base_address: 0x000000013faa0108 process_identifier: 2912 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: qw@qw qw@qwqw°qw nwàTnw 3qwqwÀ´lw`,qwÀowömw Yqw2qwVqw°wwnwRqw nwQqwÂnw ?owPnw°TnwàtnwðowÐ1qwmwÐOmw`êpwÐæpwÐæpwÐ.qw base_address: 0x000000013fafaae8 process_identifier: 2912 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013fb00c78 process_identifier: 2912 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013fe822b0 process_identifier: 2276 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: base_address: 0x000000013fe90d88 process_identifier: 2276 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I»`#å?Aÿã base_address: 0x0000000077711590 process_identifier: 2276 process_handle: 0x0000000000000050	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: ñw base_address: 0x000000013fe90d78 process_identifier: 2276 process_handle: 0x000000000000004c	1	1
WriteProcessMemory May 3, 2025, 4:36 p.m.	buffer: I» å?Aÿã base_address: 0x00000000776e7a90 process_identifier: 2276 process_handle: 0x0000000000000050	1	1

Expresses interest in specific running processes (1 event)

process: potential browser injection target

firefox.exe

One or more non-whitelisted processes were created (10 events)

parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
parent_process	firefox.exe	martian_process	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

Appends a known multi-family ransomware file extension to files that have been encrypted (2 events)

file	C:\Users\test22\AppData\Roaming\Mozilla\Firefox\Profiles\1pfa5s83.default-release\parent.lock
file	C:\Users\test22\AppData\Local\Temp\firefox\parent.lock

Resumed a suspended thread in a remote process potentially indicative of process injection (20 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2608 resumed a thread in remote process 2652
Process injection	Process 2556 resumed a thread in remote process 2620
Process injection	Process 2596 resumed a thread in remote process 2696
Process injection	Process 2920 resumed a thread in remote process 2200
Process injection	Process 2740 resumed a thread in remote process 2912
Process injection	Process 2720 resumed a thread in remote process 2276
Process injection	Process 1868 resumed a thread in remote process 2540
Process injection	Process 3088 resumed a thread in remote process 3132
Process injection	Process 3636 resumed a thread in remote process 3680
Process injection	Process 2168 resumed a thread in remote process 3200
NtResumeThread May 3, 2025, 4:36 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2652	1	0	0
NtResumeThread May 3, 2025, 4:36 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2620	1	0	0
NtResumeThread May 3, 2025, 4:36 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2696	1	0	0
NtResumeThread May 3, 2025, 4:36 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2200	1	0	0
NtResumeThread May 3, 2025, 4:36 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2912	1	0	0
NtResumeThread May 3, 2025, 4:36 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2276	1	0	0
NtResumeThread May 3, 2025, 4:37 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 2540	1	0	0
NtResumeThread May 3, 2025, 4:37 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3132	1	0	0
NtResumeThread May 3, 2025, 4:37 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3680	1	0	0
NtResumeThread May 3, 2025, 4:37 p.m.	thread_handle: 0x0000000000000044 suspend_count: 1 process_identifier: 3200	1	0	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.Win32.Formbook.dh
Cylance	Unsafe
Sangfor	Virus.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (W)
VirIT	Trojan.Win32.AutoIt_Heur.L
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/HackTool.Silentall.N potentially unsafe
Kaspersky	HEUR:Trojan.Script.Agent.gen
Rising	HackTool.Silentall/Autoit!1.106C3 (CLASSIC)
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	Trojan.Siggen30.19657
McAfeeD	ti!C75595A1EEF5
Avira	TR/ATRAPS.Gen
Microsoft	Program:Win32/Wacapew.C!ml
Malwarebytes	Malware.AI.3317982698
Ikarus	PUA.HackTool.Silentall
Tencent	Unk.Win32.Script.404958
huorong	TrojanDownloader/AutoIT.Agent.d
Fortinet	Riskware/Silentall

Executed a process and injected code into it, probably while unpacking (50 out of 210 events)

Time & API	Arguments	Status	Return
NtResumeThread May 3, 2025, 4:35 p.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1044	1	0
CreateProcessInternalW May 3, 2025, 4:35 p.m.	thread_identifier: 2132 thread_handle: 0x000001e4 process_identifier: 2128 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:35 p.m.	thread_identifier: 2288 thread_handle: 0x000001d0 process_identifier: 2284 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2372 thread_handle: 0x000001e4 process_identifier: 2368 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2452 thread_handle: 0x000001d0 process_identifier: 2448 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2532 thread_handle: 0x000001e4 process_identifier: 2528 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2612 thread_handle: 0x000001d0 process_identifier: 2608 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2824 thread_handle: 0x000001e4 process_identifier: 2820 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2140 thread_handle: 0x000001d0 process_identifier: 2144 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 1156 thread_handle: 0x000001e4 process_identifier: 2188 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2340 thread_handle: 0x000001d0 process_identifier: 2344 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2460 thread_handle: 0x000001e4 process_identifier: 2468 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2568 thread_handle: 0x000001d0 process_identifier: 2556 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2884 thread_handle: 0x000001e4 process_identifier: 2896 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2792 thread_handle: 0x000001d0 process_identifier: 2796 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2196 thread_handle: 0x000001e4 process_identifier: 2176 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2288 thread_handle: 0x000001d0 process_identifier: 2348 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2424 thread_handle: 0x000001e4 process_identifier: 2340 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001d0	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2604 thread_handle: 0x000001d0 process_identifier: 2596 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001e4	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2924 thread_handle: 0x00000218 process_identifier: 2884 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2264 thread_handle: 0x0000021c process_identifier: 516 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2304 thread_handle: 0x00000218 process_identifier: 1156 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2508 thread_handle: 0x0000021c process_identifier: 2460 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2092 thread_handle: 0x00000218 process_identifier: 2744 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2212 thread_handle: 0x0000021c process_identifier: 2920 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2524 thread_handle: 0x00000218 process_identifier: 2504 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2508 thread_handle: 0x0000021c process_identifier: 1284 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2792 thread_handle: 0x00000218 process_identifier: 288 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2400 thread_handle: 0x0000021c process_identifier: 2408 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 1208 thread_handle: 0x00000218 process_identifier: 2680 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2900 thread_handle: 0x0000021c process_identifier: 2740 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2544 thread_handle: 0x00000218 process_identifier: 2124 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2184 thread_handle: 0x0000021c process_identifier: 2280 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 2944 thread_handle: 0x00000218 process_identifier: 2948 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 652 thread_handle: 0x0000021c process_identifier: 2792 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000218	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 1340 thread_handle: 0x00000218 process_identifier: 2888 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:36 p.m.	thread_identifier: 652 thread_handle: 0x0000021c process_identifier: 2720 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000170	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 2168 thread_handle: 0x00000170 process_identifier: 2716 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 2004 thread_handle: 0x0000021c process_identifier: 792 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000170	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 1960 thread_handle: 0x00000170 process_identifier: 2928 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 1480 thread_handle: 0x0000021c process_identifier: 2516 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000170	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 1476 thread_handle: 0x00000170 process_identifier: 1076 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 916 thread_handle: 0x0000021c process_identifier: 1868 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000170	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 1340 thread_handle: 0x00000170 process_identifier: 2400 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 2000 thread_handle: 0x0000021c process_identifier: 3036 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM chrome.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000170	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 1232 thread_handle: 0x00000170 process_identifier: 2024 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM msedge.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 1520 thread_handle: 0x0000021c process_identifier: 916 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM opera.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000170	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 2000 thread_handle: 0x00000170 process_identifier: 1340 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM brave.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 3092 thread_handle: 0x0000021c process_identifier: 3088 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000170	1	1
CreateProcessInternalW May 3, 2025, 4:37 p.m.	thread_identifier: 3224 thread_handle: 0x00000170 process_identifier: 3220 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: taskkill /F /IM firefox.exe /T filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000021c	1	1

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All