File 3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe

Size 1.1MB
Type PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 246c688f975ed50aceae1554794544c9
SHA1 63ed147f42b16090946b23b2b3223f4cae9057d0
SHA256 3c4d4c77eb8fcef5f15276e3b6cbf003193a26fb198ec9bf26dbd1f369bd68a6
SHA512
c2db4d9ed8187210ac151796842235d72bfe5b29d922f54b807e0bee520697985eab244ce31713e3e0c91f2f7bd5d82b373ed3e8c58137ab06104a2c99241b31
CRC32 3FB2F0D9
ssdeep None
Yara
  • keylogger - Run a keylogger
  • win_mutex - Create or check mutex
  • win_files_operation - Affect private profile

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.


Autosubmit

Parent_Task_ID:7095204

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Nov. 23, 2025, 12:23 p.m. Nov. 23, 2025, 12:30 p.m. 390 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-11-16 14:43:02,000 [analyzer] DEBUG: Starting analyzer from: C:\tmp1xmcit
2025-11-16 14:43:02,000 [analyzer] DEBUG: Pipe server name: \??\PIPE\VKhXOllukqOXXEGDERMS
2025-11-16 14:43:02,000 [analyzer] DEBUG: Log pipe server name: \??\PIPE\JZKUgFIUwbShvbRuvVFQLRW
2025-11-16 14:43:02,000 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-11-16 14:43:02,000 [analyzer] INFO: Automatically selected analysis package "exe"
2025-11-16 14:43:02,233 [analyzer] DEBUG: Started auxiliary module Curtain
2025-11-16 14:43:02,233 [analyzer] DEBUG: Started auxiliary module DbgView
2025-11-16 14:43:02,655 [analyzer] DEBUG: Started auxiliary module Disguise
2025-11-16 14:43:02,842 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-11-16 14:43:02,890 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-11-16 14:43:02,890 [analyzer] DEBUG: Started auxiliary module Human
2025-11-16 14:43:02,890 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-11-16 14:43:02,890 [analyzer] DEBUG: Started auxiliary module Reboot
2025-11-16 14:43:02,983 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-11-16 14:43:02,983 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-11-16 14:43:02,983 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-11-16 14:43:02,983 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-11-16 14:43:03,125 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe' with arguments '' and pid 648
2025-11-16 14:43:03,358 [analyzer] DEBUG: Loaded monitor into process with pid 648
2025-11-16 14:43:03,608 [analyzer] INFO: Added new file to list with pid 648 and path C:\Users\Administrator\AppData\Local\Temp\3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
2025-11-16 14:43:04,265 [analyzer] INFO: Injected into process with pid 2904 and name ''
2025-11-16 14:43:04,437 [analyzer] DEBUG: Loaded monitor into process with pid 2904
2025-11-16 14:43:05,125 [analyzer] INFO: Process with pid 648 has terminated
2025-11-16 14:43:07,530 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\14232B434CF29D4C4FB335A86D7FFFE3
2025-11-16 14:43:07,530 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14232B434CF29D4C4FB335A86D7FFFE3
2025-11-16 14:43:07,546 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\Local\Temp\CabC4CF.tmp
2025-11-16 14:43:07,562 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\Local\Temp\TarC4D0.tmp
2025-11-16 14:43:07,717 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-11-16 14:43:07,717 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-11-16 14:43:07,733 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\Local\Temp\CabC58D.tmp
2025-11-16 14:43:07,733 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\Local\Temp\TarC58E.tmp
2025-11-16 14:43:07,937 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-11-16 14:43:07,937 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-11-16 14:43:08,000 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
2025-11-16 14:43:08,000 [analyzer] INFO: Added new file to list with pid 2904 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
2025-11-16 14:46:22,125 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-11-16 14:46:23,500 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-11-16 14:46:23,500 [lib.api.process] INFO: Successfully terminated process with pid 2904.
2025-11-16 14:46:23,546 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-11-23 12:23:54,299 [cuckoo.core.scheduler] INFO: Task #7184610: acquired machine win7x6414 (label=win7x6414)
2025-11-23 12:23:54,300 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.214 for task #7184610
2025-11-23 12:23:54,614 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3906927 (interface=vboxnet0, host=192.168.168.214)
2025-11-23 12:23:55,529 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6414
2025-11-23 12:23:56,872 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6414 to vmcloak
2025-11-23 12:25:35,315 [cuckoo.core.guest] INFO: Starting analysis #7184610 on guest (id=win7x6414, ip=192.168.168.214)
2025-11-23 12:25:36,318 [cuckoo.core.guest] DEBUG: win7x6414: not ready yet
2025-11-23 12:25:41,342 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6414, ip=192.168.168.214)
2025-11-23 12:25:41,410 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6414, ip=192.168.168.214, monitor=latest, size=6660546)
2025-11-23 12:25:43,042 [cuckoo.core.resultserver] DEBUG: Task #7184610: live log analysis.log initialized.
2025-11-23 12:25:43,854 [cuckoo.core.resultserver] DEBUG: Task #7184610 is sending a BSON stream
2025-11-23 12:25:44,410 [cuckoo.core.resultserver] DEBUG: Task #7184610 is sending a BSON stream
2025-11-23 12:25:45,135 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'shots/0001.jpg'
2025-11-23 12:25:45,157 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 113463
2025-11-23 12:25:45,415 [cuckoo.core.resultserver] DEBUG: Task #7184610 is sending a BSON stream
2025-11-23 12:25:45,648 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/3c4d4c77eb8fcef5_old_3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe'
2025-11-23 12:25:45,673 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 1114113
2025-11-23 12:25:48,648 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/d12dd18018f984aa_CabC4CF.tmp'
2025-11-23 12:25:48,651 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 58383
2025-11-23 12:25:48,655 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/78eeb661b72a34ca_TarC4D0.tmp'
2025-11-23 12:25:48,659 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 146584
2025-11-23 12:25:48,819 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/33ba8221ff3f5211_CabC58D.tmp'
2025-11-23 12:25:48,823 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 73211
2025-11-23 12:25:48,826 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/4018ab25d7d15f77_TarC58E.tmp'
2025-11-23 12:25:48,829 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 189652
2025-11-23 12:25:49,282 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'shots/0002.jpg'
2025-11-23 12:25:49,292 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 114451
2025-11-23 12:25:54,444 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'shots/0003.jpg'
2025-11-23 12:25:54,458 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 114552
2025-11-23 12:25:55,522 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'shots/0004.jpg'
2025-11-23 12:25:55,532 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 116413
2025-11-23 12:25:57,891 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:26:06,828 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'shots/0005.jpg'
2025-11-23 12:26:06,837 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 118713
2025-11-23 12:26:13,188 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:26:28,299 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:26:43,485 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:26:58,586 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:27:13,845 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:27:28,971 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:27:44,079 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:27:59,180 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:28:14,383 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:28:29,490 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:28:44,613 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:28:59,740 [cuckoo.core.guest] DEBUG: win7x6414: analysis #7184610 still processing
2025-11-23 12:29:03,362 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'curtain/1763300782.3.curtain.log'
2025-11-23 12:29:03,365 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 36
2025-11-23 12:29:04,338 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'sysmon/1763300783.28.sysmon.xml'
2025-11-23 12:29:04,555 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 15153950
2025-11-23 12:29:04,582 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/ced0683de8928455_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-11-23 12:29:04,585 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 174
2025-11-23 12:29:04,586 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/a748da4f4b503a8c_3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe'
2025-11-23 12:29:04,593 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 1114113
2025-11-23 12:29:04,606 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/ebd41040e4bb3ec7_14232b434cf29d4c4fb335a86d7fffe3'
2025-11-23 12:29:04,613 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 889
2025-11-23 12:29:04,615 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/6fb1b8e593cb0388_b46811c17859ffb409cf0e904a4aa8f8'
2025-11-23 12:29:04,617 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 530
2025-11-23 12:29:04,619 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/dab93e98d76f6f4a_94308059b57b3142e455b38a6eb92015'
2025-11-23 12:29:04,624 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 344
2025-11-23 12:29:04,632 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/0f71708dbfee304a_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-11-23 12:29:04,634 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 1739
2025-11-23 12:29:04,635 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/ae7372d3329ebd40_14232b434cf29d4c4fb335a86d7fffe3'
2025-11-23 12:29:04,636 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 170
2025-11-23 12:29:04,637 [cuckoo.core.resultserver] DEBUG: Task #7184610: File upload for 'files/984e7e2dc940ac1d_b46811c17859ffb409cf0e904a4aa8f8'
2025-11-23 12:29:04,639 [cuckoo.core.resultserver] DEBUG: Task #7184610 uploaded file length: 170
2025-11-23 12:29:04,640 [cuckoo.core.resultserver] DEBUG: Task #7184610 had connection reset for <Context for LOG>
2025-11-23 12:29:05,777 [cuckoo.core.guest] INFO: win7x6414: analysis completed successfully
2025-11-23 12:29:05,792 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-11-23 12:29:05,815 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-11-23 12:29:06,763 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6414 to path /srv/cuckoo/cwd/storage/analyses/7184610/memory.dmp
2025-11-23 12:29:06,766 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6414
2025-11-23 12:30:24,321 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.214 for task #7184610
2025-11-23 12:30:24,895 [cuckoo.core.scheduler] DEBUG: Released database task #7184610
2025-11-23 12:30:24,908 [cuckoo.core.scheduler] INFO: Task #7184610: analysis procedure completed

Signatures

Yara rules detected for file (3 events)
description Run a keylogger rule keylogger
description Create or check mutex rule win_mutex
description Affect private profile rule win_files_operation
Allocates read-write-execute memory (usually to unpack itself) (20 events)
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 1130496
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01740000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 667648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 184320
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 282624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00430000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00475000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00479000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 667648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0ee10000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 274432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00413000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00415000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00418000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2904
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)
section .l1
section CPADinfo
One or more processes crashed (26 events)
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 89783280
registers.edi: 23341536
registers.eax: 17
registers.ebp: 89783324
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 109640688
registers.edi: 23341536
registers.eax: 17
registers.ebp: 109640732
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 126417904
registers.edi: 23341536
registers.eax: 17
registers.ebp: 126417948
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 143195120
registers.edi: 23341536
registers.eax: 17
registers.ebp: 143195164
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 159972336
registers.edi: 23341536
registers.eax: 17
registers.ebp: 159972380
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 176749552
registers.edi: 23341536
registers.eax: 17
registers.ebp: 176749596
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 193526768
registers.edi: 23341536
registers.eax: 17
registers.ebp: 193526812
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 210303984
registers.edi: 23341536
registers.eax: 17
registers.ebp: 210304028
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 228129776
registers.edi: 23341536
registers.eax: 17
registers.ebp: 228129820
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 247069680
registers.edi: 23341536
registers.eax: 17
registers.ebp: 247069724
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x74a3185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x76aad57a
I_CryptNetGetConnectivity+0x6df I_CryptNetSetUrlCachePreFetchInfo-0x1947 cryptnet+0x738a @ 0x7380738a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 247070288
registers.edi: 23341536
registers.eax: 17
registers.ebp: 247070332
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 249166832
registers.edi: 23341536
registers.eax: 17
registers.ebp: 249166876
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x74a3185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x76aad57a
I_CryptNetGetConnectivity+0x6df I_CryptNetSetUrlCachePreFetchInfo-0x1947 cryptnet+0x738a @ 0x7380738a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 249167440
registers.edi: 23341536
registers.eax: 17
registers.ebp: 249167484
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 249166832
registers.edi: 23341536
registers.eax: 17
registers.ebp: 249166876
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x74a3185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x76aad57a
I_CryptNetGetConnectivity+0x6df I_CryptNetSetUrlCachePreFetchInfo-0x1947 cryptnet+0x738a @ 0x7380738a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 249167440
registers.edi: 23341536
registers.eax: 17
registers.ebp: 249167484
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 249166832
registers.edi: 23341536
registers.eax: 17
registers.ebp: 249166876
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
RtlFindMessage+0x7e9 RtlEqualString-0x9e ntdll+0x60546 @ 0x76ff0546
RtlDecodePointer+0xf7 LdrInitializeThunk-0x1d ntdll+0x39ecc @ 0x76fc9ecc
LdrInitializeThunk+0x10 RtlInitializeExceptionChain-0x16 ntdll+0x39ef9 @ 0x76fc9ef9

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 266664944
registers.edi: 23341536
registers.eax: 17
registers.ebp: 266664988
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x74a3185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x76aad57a
I_CryptNetGetConnectivity+0x6df I_CryptNetSetUrlCachePreFetchInfo-0x1947 cryptnet+0x738a @ 0x7380738a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 266665552
registers.edi: 23341536
registers.eax: 17
registers.ebp: 266665596
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
BaseThreadInitThunk+0x19 VerifyConsoleIoHandle-0xac kernel32+0x133b1 @ 0x76a933b1
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 126418608
registers.edi: 23341536
registers.eax: 17
registers.ebp: 126418652
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x74a3185c
FreeLibraryAndExitThread+0x10 GetExitCodeThread-0x23 kernel32+0x2d57a @ 0x76aad57a
I_CryptFreeLruCache+0x683 I_CryptFindLruEntryData-0x15ee crypt32+0x38e4e @ 0x74aa8e4e
I_CryptFreeLruCache+0x649 I_CryptFindLruEntryData-0x1628 crypt32+0x38e14 @ 0x74aa8e14
CertSerializeCRLStoreElement+0x571 I_CryptFreeLruCache-0x196 crypt32+0x38635 @ 0x74aa8635
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 249167396
registers.edi: 23341536
registers.eax: 17
registers.ebp: 249167440
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
RtlFindMessage+0x5c4 RtlEqualString-0x2c3 ntdll+0x60321 @ 0x76ff0321
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 176749908
registers.edi: 23341536
registers.eax: 17
registers.ebp: 176749952
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
RtlFindMessage+0x5c4 RtlEqualString-0x2c3 ntdll+0x60321 @ 0x76ff0321
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 193527124
registers.edi: 23341536
registers.eax: 17
registers.ebp: 193527168
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
RtlFindMessage+0x5c4 RtlEqualString-0x2c3 ntdll+0x60321 @ 0x76ff0321
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 109641044
registers.edi: 23341536
registers.eax: 17
registers.ebp: 109641088
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
FreeLibraryAndExitThread+0x5f DisableThreadLibraryCalls-0x6 kernelbase+0x1185c @ 0x74a3185c
CoGetTreatAsClass+0x3164 CoRegisterChannelHook-0x71e ole32+0x2d893 @ 0x7507d893
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 228130436
registers.edi: 23341536
registers.eax: 17
registers.ebp: 228130480
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
RtlFindMessage+0x5c4 RtlEqualString-0x2c3 ntdll+0x60321 @ 0x76ff0321
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 89783636
registers.edi: 23341536
registers.eax: 17
registers.ebp: 89783680
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0

__exception__

stacktrace:
wcsncpy_s+0x1c3 RtlIdentifierAuthoritySid-0x24 ntdll+0x6e57d @ 0x76ffe57d
RtlExitUserThread+0x2a RtlCleanUpTEBLangLists-0x38 ntdll+0x58046 @ 0x76fe8046
RtlFindMessage+0x5c4 RtlEqualString-0x2c3 ntdll+0x60321 @ 0x76ff0321
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133aa @ 0x76a933aa
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x76fc9f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x76fc9f45

exception.instruction_r: 83 3e 00 0f 85 18 d8 01 00 c7 45 fc fe ff ff ff
exception.symbol: RtlFindMessage+0x671 RtlEqualString-0x216 ntdll+0x603ce
exception.instruction: cmp dword ptr [esi], 0
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 394190
exception.address: 0x76ff03ce
registers.esp: 159972692
registers.edi: 23341536
registers.eax: 17
registers.ebp: 159972736
registers.edx: 1997086848
registers.ebx: 23342416
registers.esi: 4956160
registers.ecx: 17
1 0 0
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Creates executable files on the filesystem (1 event)
file C:\Users\Administrator\AppData\Local\Temp\3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
Drops a binary and executes it (1 event)
file C:\Users\Administrator\AppData\Local\Temp\3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
Drops an executable to the user AppData folder (2 events)
file C:\Users\Administrator\AppData\Local\Temp\old_3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
file C:\Users\Administrator\AppData\Local\Temp\3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)
Moves the original executable to a new location (1 event)
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

newfilepath_r: C:\Users\Administrator\AppData\Local\Temp\old_3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
flags: 2
oldfilepath_r: C:\Users\Administrator\AppData\Local\Temp\3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
newfilepath: C:\Users\Administrator\AppData\Local\Temp\old_3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
oldfilepath: C:\Users\Administrator\AppData\Local\Temp\3c4d4c77eb8fcef5_9af0a7078db1596238683e4bb81599984533c07c159fe8163b0f101098acee4b.exe
1 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 event)
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 46
family: 0
1 0 0
The binary likely contains encrypted or compressed data indicative of a packer (3 events)
section {u'size_of_data': u'0x00014600', u'virtual_address': u'0x00001000', u'entropy': 6.911756338536248, u'name': u'.rsrc', u'virtual_size': u'0x00014440'} entropy 6.91175633854 description A section with a high entropy has been found
section {u'size_of_data': u'0x0009e400', u'virtual_address': u'0x00018000', u'entropy': 7.907378380576991, u'name': u'.rdata', u'virtual_size': u'0x0009e304'} entropy 7.90737838058 description A section with a high entropy has been found
entropy 0.681124880839 description Overall entropy of this PE file is high
Attempts to create or modify system certificates (1 event)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (10 events)
Time & API Arguments Status Return Repeated

RegSetValueExW

key_handle: 0x000002d0
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionReason
1 0 0

RegSetValueExW

key_handle: 0x000002d0
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: Xáö»WÜ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecisionTime
1 0 0

RegSetValueExW

key_handle: 0x000002d0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadDecision
1 0 0

RegSetValueExW

key_handle: 0x000002d0
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
value: Network
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{092F0E6C-7874-4263-8D41-969F2B667EA2}\WpadNetworkName
1 0 0

RegSetValueExW

key_handle: 0x00000564
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

key_handle: 0x00000564
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: Xáö»WÜ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

key_handle: 0x00000564
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0

RegSetValueExW

key_handle: 0x00000564
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
value: 1
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
1 0 0

RegSetValueExW

key_handle: 0x00000564
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
value: Xáö»WÜ
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
1 0 0

RegSetValueExW

key_handle: 0x00000564
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
1 0 0
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Gen:Variant.Barys.318206 (Engine A), Win32.Trojan.PSE.707O5V (Engine B)
Avast Core Security (Linux) Win32:Evo-gen [Trj]
C4S ClamAV (Linux) Win.Packed.Razy-9836307-0
Trellix (Linux) Trojan-FVOQ
WithSecure (Linux) Trojan.TR/Dropper.Gen
eScan Antivirus (Linux) Gen:Variant.Barys.318206(DB)
ESET Security (Windows) a variant of Win32/Kryptik.GIRH trojan
Sophos Anti-Virus (Linux) Troj/Agent-BFEY
DrWeb Antivirus (Linux) Trojan.Packed2.49423
ClamAV (Linux) Win.Packed.Razy-9836307-0
Bitdefender Antivirus (Linux) Gen:Variant.Barys.318206
Kaspersky Standard (Windows) HEUR:Trojan.Win32.Generic
Emsisoft Commandline Scanner (Windows) Gen:Variant.Barys.318206 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.