What is gennt.exe?

gennt.exe is developed by IObit according to the gennt.exe version information.

gennt.exe is usually located in the 'C:\ProgramData\2bd20eaa905c1c6a2d7d\' folder.

Some of the anti-virus scanners at VirusTotal detected gennt.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

The following is the available information on gennt.exe:

PropertyValue
Company nameIObit

Here's a screenshot of the file properties when displayed by Windows Explorer:

Company nameIObit

Digital signatures [?]

The verification of gennt.exe's digital signature failed.

PropertyValue
Signer nameLETVTCCVPRDGGWDAJF
Certificate issuer nameLETVTCCVPRDGGWDAJF
Certificate serial number3a5a5e443d423fad44b1c09e226cd7f1

VirusTotal report

38 of the 69 anti-virus programs at VirusTotal detected the gennt.exe file. That's a 55% detection rate.

ScannerDetection Name
Acronis suspicious
Ad-Aware Gen:Variant.Razy.699949
ALYac Gen:Variant.Razy.699949
Antiy-AVL GrayWare/Win32.Kryptik.ehls
APEX Malicious
Arcabit Trojan.Razy.DAAE2D
Avast Win32:DangerousSig [Trj]
AVG Win32:DangerousSig [Trj]
Avira TR/AD.BuerLoader.JK
BitDefender Gen:Variant.Razy.699949
BitDefenderTheta Gen:NN.ZexaF.34144.gm1@aC1XyHib
Bkav W32.AIDetectVM.malware1
CrowdStrike win/malicious_confidence_80% (D)
Cybereason malicious.db3572
Cylance Unsafe
Cynet Malicious (score: 100)
eGambit Unsafe.AI_Score_71%
Elastic malicious (high confidence)
Emsisoft Gen:Variant.Razy.699949 (B)
ESET-NOD32 a variant of Win32/GenKryptik.EMWX
F-Secure Trojan.TR/AD.BuerLoader.JK
FireEye Generic.mg.d7610471691672af
Fortinet W32/GenKryptik.EOOB!tr
GData Win32.Trojan.Kryptik.PY
Invincea heuristic
Kaspersky Trojan-Downloader.Win32.Buerak.pe
MAX malware (ai score=85)
McAfee Drixed-FJQ!D76104716916
Microsoft Trojan:Win32/Amadey.GM!MTB
MicroWorld-eScan Gen:Variant.Razy.699949
Qihoo-360 HEUR/QVM20.1.EEC9.Malware.Gen
Rising Malware.Heuristic!ET#99% (RDMK:cmRtazr0mU2ktl6RJpgz6eXo3cz0)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Mal/EncPk-APV
Symantec Packed.Generic.459
VBA32 Malware-Cryptor.Limpopo
ZoneAlarm Trojan-Downloader.Win32.Buerak.pe
38 of the 69 anti-virus programs detected the gennt.exe file.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Summary

{
    "file_created": [
        "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
    ],
    "directory_created": [
        "C:\\ProgramData\\4b82648b808e5d3665ad"
    ],
    "dll_loaded": [
        "DNSAPI.dll",
        "KERNEL32.dll",
        "netapi32.dll",
        "ntdll.dll",
        "cryptsp.dll",
        "winhttp.dll",
        "C:\\Windows\\System32\\wship6.dll",
        "SspiCli.dll",
        "advapi32.dll",
        "ole32.dll",
        "SHLWAPI.dll",
        "credssp.dll",
        "cscapi.dll",
        "IPHLPAPI.DLL",
        "shell32.dll",
        "CFGMGR32.dll",
        "SHELL32.dll",
        "RPCRT4.dll",
        "wkscli.dll",
        "NSI.dll",
        "kernel32.dll",
        "C:\\Windows\\system32\\mswsock.dll",
        "ADVAPI32.dll",
        "rpcrt4.dll",
        "C:\\Windows\\System32\\wshtcpip.dll",
        "WS2_32.dll",
        "user32.dll",
        "Winhttp.dll"
    ],
    "file_opened": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
        "\\\\?\\PIPE\\wkssvc",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
        "c:\\",
        "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
    ],
    "regkey_opened": [
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\SspiCli",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
        "HKEY_CLASSES_ROOT\\interfacE\\{b196b287-bab4-101a-b69c-00aa00341d07}",
        "HKEY_CURRENT_USER",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\IDConfigDB",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SspiCache"
    ],
    "resolves_host": [
        "unlimitedvideo.top"
    ],
    "file_written": [
        "\\\\?\\PIPE\\wkssvc",
        "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
    ],
    "file_deleted": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin"
    ],
    "file_exists": [
        "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
    ],
    "file_failed": [
        "\\??\\L:",
        "\\??\\N:",
        "\\??\\U:",
        "\\??\\H:",
        "\\??\\W:",
        "\\??\\J:",
        "\\??\\Q:",
        "\\??\\D:",
        "\\??\\S:",
        "\\??\\F:",
        "\\??\\B:",
        "\\??\\M:",
        "\\??\\X:",
        "\\??\\Z:",
        "\\??\\O:",
        "\\??\\I:",
        "\\??\\T:",
        "\\??\\V:",
        "\\??\\K:",
        "\\??\\E:",
        "\\??\\P:",
        "\\??\\R:",
        "\\??\\G:",
        "\\??\\A:",
        "\\??\\Y:"
    ],
    "command_line": [
        "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe \"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin\" ensgJJ",
        "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
    ],
    "file_read": [
        "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
        "\\\\?\\PIPE\\wkssvc",
        "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
    ],
    "regkey_read": [
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\UseDelayedAcceptance",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\HwProfileGuid",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{B196B287-BAB4-101A-B69C-00AA00341D07}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MinSockaddrLength",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip\\WinSock 2.0 Provider ID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo\\DockingState",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\FriendlyName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentConfig",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MaxSockaddrLength",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\HelperDllName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\Mapping",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type"
    ],
    "regkey_written": [
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
    ]
}

Dropped

[
    {
        "yara": [],
        "sha1": "2f44eebdb35724e49d7092886e2feb6e5e627cc4",
        "name": "becdfa7b36f909e4_becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
        "filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
        "type": "PE32 executable (GUI) Intel 80386, for MS Windows",
        "sha256": "becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100",
        "urls": [
            "https:\/\/www.example.com\/my_product\/info.html0"
        ],
        "crc32": "DDBF997E",
        "path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/8805\/files\/becdfa7b36f909e4_becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
        "ssdeep": null,
        "size": 111168,
        "sha512": "ed44f9e93411ee1432c8fc438a2596eb5192cab73d61f7bda5bdd4538ffcdc54df88d73a8a9f7312216df4dcf2ef95ad4b14484c21b39aed3157ee6b5325e180",
        "pids": [],
        "md5": "d7610471691672af41aec15c4880d60e"
    }
]

Generic

[
    {
        "process_path": "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe",
        "process_name": "gennt.exe",
        "pid": 856,
        "summary": {
            "directory_created": [
                "C:\\ProgramData\\4b82648b808e5d3665ad"
            ],
            "dll_loaded": [
                "DNSAPI.dll",
                "KERNEL32.dll",
                "netapi32.dll",
                "ntdll.dll",
                "cryptsp.dll",
                "winhttp.dll",
                "C:\\Windows\\System32\\wship6.dll",
                "SspiCli.dll",
                "advapi32.dll",
                "ole32.dll",
                "SHLWAPI.dll",
                "credssp.dll",
                "cscapi.dll",
                "IPHLPAPI.DLL",
                "shell32.dll",
                "CFGMGR32.dll",
                "SHELL32.dll",
                "RPCRT4.dll",
                "wkscli.dll",
                "NSI.dll",
                "kernel32.dll",
                "C:\\Windows\\system32\\mswsock.dll",
                "ADVAPI32.dll",
                "rpcrt4.dll",
                "C:\\Windows\\System32\\wshtcpip.dll",
                "WS2_32.dll",
                "user32.dll",
                "Winhttp.dll"
            ],
            "file_opened": [
                "\\\\?\\PIPE\\wkssvc",
                "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
                "c:\\",
                "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
            ],
            "regkey_opened": [
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LsaExtensionConfig\\SspiCli",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Winsock",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Setup Migration\\Providers",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecurityProviders\\SaslProfiles",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing",
                "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Ole",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Winsock\\Parameters",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
                "HKEY_CLASSES_ROOT\\interfacE\\{b196b287-bab4-101a-b69c-00aa00341d07}",
                "HKEY_CURRENT_USER",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Winsock",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\IDConfigDB",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SspiCache"
            ],
            "resolves_host": [
                "unlimitedvideo.top"
            ],
            "file_written": [
                "\\\\?\\PIPE\\wkssvc"
            ],
            "file_deleted": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin"
            ],
            "file_failed": [
                "\\??\\L:",
                "\\??\\N:",
                "\\??\\U:",
                "\\??\\H:",
                "\\??\\W:",
                "\\??\\J:",
                "\\??\\Q:",
                "\\??\\D:",
                "\\??\\S:",
                "\\??\\F:",
                "\\??\\B:",
                "\\??\\M:",
                "\\??\\X:",
                "\\??\\Z:",
                "\\??\\O:",
                "\\??\\I:",
                "\\??\\T:",
                "\\??\\V:",
                "\\??\\K:",
                "\\??\\E:",
                "\\??\\P:",
                "\\??\\R:",
                "\\??\\G:",
                "\\??\\A:",
                "\\??\\Y:"
            ],
            "command_line": [
                "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
            ],
            "file_read": [
                "\\\\?\\PIPE\\wkssvc",
                "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\TokenSize",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\UseDelayedAcceptance",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\MaxRpcSize",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\HwProfileGuid",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Capabilities",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\RpcId",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\UseDelayedAcceptance",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{B196B287-BAB4-101A-B69C-00AA00341D07}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureRoutine",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\SecurityProviders",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MinSockaddrLength",
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadOverride",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip\\WinSock 2.0 Provider ID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ShareCredsWithWinHttp",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo\\DockingState",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\Tracing\\Enabled",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MinSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\FriendlyName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\OOBEInProgress",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\LsaExtensionConfig\\SspiCli\\CheckSignatureDll",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\Mapping",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Comment",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Name",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp\\DisableBranchCache",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentConfig",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\MaxSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ActiveComputerName\\ComputerName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\MaxSockaddrLength",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\HelperDllName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TCPIP6\\Parameters\\Winsock\\HelperDllName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Setup Migration\\Providers\\Tcpip6\\WinSock 2.0 Provider ID",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\MaximumAllowedAllocationSize",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxySettingsPerUser",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winsock\\Parameters\\Transports",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Winsock\\Mapping",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\WinHttpSettings",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Version",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\SspiCache\\credssp.dll\\Type"
            ],
            "regkey_written": [
                "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
            ]
        },
        "first_seen": 1596945190.90625,
        "ppid": 2436
    },
    {
        "process_path": "C:\\Windows\\System32\\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1596945190.34375,
        "ppid": 376
    },
    {
        "process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
        "process_name": "becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
        "pid": 2436,
        "summary": {
            "file_created": [
                "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
            ],
            "directory_created": [
                "C:\\ProgramData\\4b82648b808e5d3665ad"
            ],
            "dll_loaded": [
                "KERNEL32.dll",
                "shell32.dll",
                "kernel32.dll",
                "netapi32.dll",
                "advapi32.dll",
                "SHELL32.dll",
                "ntdll.dll",
                "user32.dll",
                "Winhttp.dll"
            ],
            "file_opened": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
                "c:\\"
            ],
            "regkey_opened": [
                "HKEY_CLASSES_ROOT\\interfacE\\{b196b287-bab4-101a-b69c-00aa00341d07}",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001",
                "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\IDConfigDB",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo"
            ],
            "file_written": [
                "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
            ],
            "file_exists": [
                "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe"
            ],
            "command_line": [
                "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe \"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin\" ensgJJ"
            ],
            "file_read": [
                "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin"
            ],
            "regkey_read": [
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{B196B287-BAB4-101A-B69C-00AA00341D07}\\(Default)",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentConfig",
                "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\FriendlyName",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\Hardware Profiles\\0001\\HwProfileGuid",
                "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\IDConfigDB\\CurrentDockInfo\\DockingState"
            ]
        },
        "first_seen": 1596945190.625,
        "ppid": 2308
    }
]

Signatures

[
    {
        "markcount": 12,
        "families": [],
        "description": "Queries for the computername",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 111,
                    "nt_status": -1073741568,
                    "api": "GetComputerNameW",
                    "return_value": 0,
                    "arguments": {
                        "computer_name": ""
                    },
                    "time": 1596945190.812,
                    "tid": 2124,
                    "flags": {}
                },
                "pid": 2436,
                "type": "call",
                "cid": 1022
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetComputerNameW",
                    "return_value": 1,
                    "arguments": {
                        "computer_name": "CUCKPC"
                    },
                    "time": 1596945190.812,
                    "tid": 2124,
                    "flags": {}
                },
                "pid": 2436,
                "type": "call",
                "cid": 1024
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 111,
                    "nt_status": -1073741568,
                    "api": "GetComputerNameW",
                    "return_value": 0,
                    "arguments": {
                        "computer_name": ""
                    },
                    "time": 1596945191.07825,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1019
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetComputerNameW",
                    "return_value": 1,
                    "arguments": {
                        "computer_name": "CUCKPC"
                    },
                    "time": 1596945191.07825,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1021
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 111,
                    "nt_status": -1073741568,
                    "api": "GetComputerNameW",
                    "return_value": 0,
                    "arguments": {
                        "computer_name": ""
                    },
                    "time": 1596945191.60925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1103
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetComputerNameW",
                    "return_value": 1,
                    "arguments": {
                        "computer_name": "CUCKPC"
                    },
                    "time": 1596945191.60925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1105
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 111,
                    "nt_status": -1073741568,
                    "api": "GetComputerNameW",
                    "return_value": 0,
                    "arguments": {
                        "computer_name": ""
                    },
                    "time": 1596945191.60925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1133
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetComputerNameW",
                    "return_value": 1,
                    "arguments": {
                        "computer_name": "CUCKPC"
                    },
                    "time": 1596945191.60925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1135
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 111,
                    "nt_status": -1073741568,
                    "api": "GetComputerNameW",
                    "return_value": 0,
                    "arguments": {
                        "computer_name": ""
                    },
                    "time": 1596945191.60925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1173
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetComputerNameW",
                    "return_value": 1,
                    "arguments": {
                        "computer_name": "CUCKPC"
                    },
                    "time": 1596945191.60925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1175
            },
            {
                "call": {
                    "category": "misc",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 111,
                    "nt_status": -1073741568,
                    "api": "GetComputerNameW",
                    "return_value": 0,
                    "arguments": {
                        "computer_name": ""
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1364
            },
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetComputerNameW",
                    "return_value": 1,
                    "arguments": {
                        "computer_name": "CUCKPC"
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1366
            }
        ],
        "references": [],
        "name": "antivm_queries_computername"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "system",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GlobalMemoryStatusEx",
                    "return_value": 1,
                    "arguments": {},
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1249
            }
        ],
        "references": [],
        "name": "antivm_memory_available"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "The file contains an unknown PE resource name possibly indicative of a packer",
        "severity": 1,
        "marks": [
            {
                "category": "resource name",
                "ioc": "MAD",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "pe_unknown_resource_name"
    },
    {
        "markcount": 0,
        "families": [],
        "description": "One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.",
        "severity": 2,
        "marks": [],
        "references": [],
        "name": "dumped_buffer"
    },
    {
        "markcount": 6,
        "families": [],
        "description": "Allocates read-write-execute memory (usually to unpack itself)",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2436,
                        "region_size": 45056,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 12288,
                        "base_address": "0x00330000"
                    },
                    "time": 1596945190.734,
                    "tid": 2124,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 2436,
                "type": "call",
                "cid": 54
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2436,
                        "region_size": 40960,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 12288,
                        "base_address": "0x00340000"
                    },
                    "time": 1596945190.797,
                    "tid": 2124,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 2436,
                "type": "call",
                "cid": 958
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2436,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 49152,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x00400000"
                    },
                    "time": 1596945190.797,
                    "tid": 2124,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 2436,
                "type": "call",
                "cid": 959
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 856,
                        "region_size": 45056,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 12288,
                        "base_address": "0x004c0000"
                    },
                    "time": 1596945190.98425,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 54
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 856,
                        "region_size": 40960,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "allocation_type": 12288,
                        "base_address": "0x004d0000"
                    },
                    "time": 1596945191.06225,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 958
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtProtectVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 856,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "length": 49152,
                        "protection": 64,
                        "process_handle": "0xffffffff",
                        "base_address": "0x00400000"
                    },
                    "time": 1596945191.06225,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 959
            }
        ],
        "references": [],
        "name": "allocates_rwx"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "misc",
                    "status": 1,
                    "stacktrace": [],
                    "api": "GetDiskFreeSpaceExW",
                    "return_value": 1,
                    "arguments": {
                        "root_path": "C:\\",
                        "free_bytes_available": 23513976832,
                        "total_number_of_free_bytes": 23513976832,
                        "total_number_of_bytes": 34252779520
                    },
                    "time": 1596945191.60925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1183
            }
        ],
        "references": [],
        "name": "antivm_disk_size"
    },
    {
        "markcount": 11,
        "families": [],
        "description": "Foreign language identified in PE resource",
        "severity": 2,
        "marks": [
            {
                "name": "RT_ICON",
                "language": "LANG_CHINESE",
                "offset": "0x0001ae20",
                "filetype": "data",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x000008a8"
            },
            {
                "name": "RT_RCDATA",
                "language": "LANG_CHINESE",
                "offset": "0x0001b7e8",
                "filetype": "ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000514"
            },
            {
                "name": "RT_RCDATA",
                "language": "LANG_CHINESE",
                "offset": "0x0001b7e8",
                "filetype": "ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000514"
            },
            {
                "name": "RT_RCDATA",
                "language": "LANG_CHINESE",
                "offset": "0x0001b7e8",
                "filetype": "ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000514"
            },
            {
                "name": "RT_RCDATA",
                "language": "LANG_CHINESE",
                "offset": "0x0001b7e8",
                "filetype": "ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000514"
            },
            {
                "name": "RT_RCDATA",
                "language": "LANG_CHINESE",
                "offset": "0x0001b7e8",
                "filetype": "ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000514"
            },
            {
                "name": "RT_RCDATA",
                "language": "LANG_CHINESE",
                "offset": "0x0001b7e8",
                "filetype": "ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000514"
            },
            {
                "name": "RT_RCDATA",
                "language": "LANG_CHINESE",
                "offset": "0x0001b7e8",
                "filetype": "ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000514"
            },
            {
                "name": "RT_RCDATA",
                "language": "LANG_CHINESE",
                "offset": "0x0001b7e8",
                "filetype": "ASCII text, with CRLF line terminators",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000514"
            },
            {
                "name": "RT_GROUP_ICON",
                "language": "LANG_CHINESE",
                "offset": "0x0001b6c8",
                "filetype": "MS Windows icon resource - 1 icon, 32x32",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000014"
            },
            {
                "name": "RT_VERSION",
                "language": "LANG_CHINESE",
                "offset": "0x0001b6e0",
                "filetype": "PDP-11 pure executable not stripped",
                "sublanguage": "SUBLANG_CHINESE_SIMPLIFIED",
                "type": "generic",
                "size": "0x00000108"
            }
        ],
        "references": [],
        "name": "origin_langid"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Drops an executable to the user AppData folder",
        "severity": 2,
        "marks": [
            {
                "category": "file",
                "ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "exe_appdata"
    },
    {
        "markcount": 24,
        "families": [],
        "description": "Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32FirstW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "[System Process]",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 0
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1317
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "System",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 4
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1318
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "smss.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 252
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1319
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "csrss.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 328
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1320
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "wininit.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 376
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1321
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "csrss.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 384
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1322
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "winlogon.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 424
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1323
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "services.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 468
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1324
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "lsass.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 476
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1325
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "lsm.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 484
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1326
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 592
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1327
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 660
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1328
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 712
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1329
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 804
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1330
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 880
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1331
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 276
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1332
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 480
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1333
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "spoolsv.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 1084
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1334
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 1120
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1335
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 1216
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1336
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "svchost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 1548
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1337
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "taskhost.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 1724
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1338
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "dwm.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 1768
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1339
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "Process32NextW",
                    "return_value": 1,
                    "arguments": {
                        "process_name": "explorer.exe",
                        "snapshot_handle": "0x00000158",
                        "process_identifier": 1788
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1340
            }
        ],
        "references": [],
        "name": "injection_process_search"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Checks adapter addresses which can be used to detect virtual network interfaces",
        "severity": 2,
        "marks": [
            {
                "call": {
                    "category": "network",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 0,
                    "nt_status": -1073741772,
                    "api": "GetAdaptersAddresses",
                    "return_value": 111,
                    "arguments": {
                        "flags": 15,
                        "family": 0
                    },
                    "time": 1596945191.64125,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1614
            }
        ],
        "references": [],
        "name": "antivm_network_adapters"
    },
    {
        "markcount": 3,
        "families": [],
        "description": "The binary likely contains encrypted or compressed data indicative of a packer",
        "severity": 2,
        "marks": [
            {
                "entropy": 7.182257703826113,
                "section": {
                    "size_of_data": "0x0000c200",
                    "virtual_address": "0x00006000",
                    "entropy": 7.182257703826113,
                    "name": ".data",
                    "virtual_size": "0x0000c15c"
                },
                "type": "generic",
                "description": "A section with a high entropy has been found"
            },
            {
                "entropy": 7.1735752604921394,
                "section": {
                    "size_of_data": "0x0000a800",
                    "virtual_address": "0x00013000",
                    "entropy": 7.1735752604921394,
                    "name": ".rsrc",
                    "virtual_size": "0x0000a768"
                },
                "type": "generic",
                "description": "A section with a high entropy has been found"
            },
            {
                "entropy": 0.8457943925233645,
                "type": "generic",
                "description": "Overall entropy of this PE file is high"
            }
        ],
        "references": [
            "http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
            "http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
        ],
        "name": "packer_entropy"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Allocates execute permission to another process indicative of possible code injection",
        "severity": 3,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2820,
                        "region_size": 122880,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0x000000dc",
                        "allocation_type": 12288,
                        "base_address": "0x000b0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 1060
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2820,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0x000000dc",
                        "allocation_type": 12288,
                        "base_address": "0x000d0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 1061
            }
        ],
        "references": [],
        "name": "allocates_execute_remote_process"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Installs itself for autorun at Windows startup",
        "severity": 3,
        "marks": [
            {
                "type": "generic",
                "reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
                "reg_value": "explorer.exe, \"C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe\""
            }
        ],
        "references": [],
        "name": "persistence_autorun"
    },
    {
        "markcount": 3,
        "families": [],
        "description": "Manipulates memory of a non-child process indicative of process injection",
        "severity": 3,
        "marks": [
            {
                "category": "Process injection",
                "ioc": "Process 856 manipulating memory of non-child process 2820",
                "type": "ioc",
                "description": null
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2820,
                        "region_size": 122880,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0x000000dc",
                        "allocation_type": 12288,
                        "base_address": "0x000b0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 1060
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2820,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0x000000dc",
                        "allocation_type": 12288,
                        "base_address": "0x000d0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 1061
            }
        ],
        "references": [
            "www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
        ],
        "name": "injection_modifies_memory"
    },
    {
        "markcount": 4,
        "families": [],
        "description": "Potential code injection by writing to the memory of another process",
        "severity": 3,
        "marks": [
            {
                "category": "Process injection",
                "ioc": "Process 856 injected into non-child 2820",
                "type": "ioc",
                "description": null
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080\u0000\u0000\u0000\u000e\u001f\u00ba\u000e\u0000\u00b4\t\u00cd!\u00b8\u0001L\u00cd!This program cannot be run in DOS mode.\r\r\n$\u0000\u0000\u0000\u0000\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0003\u0000\fk\u00ef^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u000f!\u000b\u0001\u00022\u0000B\u0000\u0000\u0000j\u0001\u0000\u0000\u0000\u0000\u0000 \u0012\u0000\u0000\u0000\u0010\u0000\u0000\u0000`\u0000\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0001\u0000\u0000\u0002\u0000\u0000\u00c7Z\u0002\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\u0018\u0001\u0000x\u0000\u0000\u0000\u00000\u0001\u0000x\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ae\u0001\u0000@\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u001a\u0001\u0000X\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u00e1A\u0000\u0000\u0000\u0010\u0000\u0000\u0000B\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.data\u0000\u0000\u0000\\\u00c1\u0000\u0000\u0000`\u0000\u0000\u0000\u00c2\u0000\u0000\u0000D\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000h\u00a7\u0000\u0000\u00000\u0001\u0000\u0000\u00a8\u0000\u0000\u0000\u0006\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000b0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1062
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "\u0000\u0000\u000b\u0000\u0000\u0000\u000b\u00004\u0018\f\u0000\u00d0\u00e1\u00bbw\u00b5\u00e6\u00bbw:\u00c4\u00bcw\u00aa\u0001\u00bcw&\u00e1\u00bbw",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000d0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1081
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "U\u008b\u00ec\u0083\u00e4\u00f8\u0083\u00ec,SV\u008bu\bW\u008b\u001e\u008b~\u0004\u008bC<\u0003\u00c3\u0089D$\u001c+X4\u0083?\u0000t_\u008dG\u0004\u0089D$\u0014\u008b\u0000\u0083\u00f8\brF\u0083\u00c0\u00f8\u00d1\u00e8\u0089D$\u0010\u00ba\u0000\u0000\u0000\u0000t6\u000f\u00b7DW\b\u008b\u00c8\u00c1\u00e8\f\u0081\u00e1\u00ff\u000f\u0000\u0000\u0083\u00f8\u0003t\u0013\u0083\u00f8\nu\u0015\u008b\u0007\u0003\u0006\u0003\u00c1\u0001\u0018\u0083P\u0004\u0000\u00eb\u0007\u008b\u0007\u0003\u0006\u0001\u001c\bB;T$\u0010r\u00ca\u008bD$\u0014\u00038\u0083?\u0000u\u00a1\u008b^\b\u0089\\$\u0010\u008bK\f\u0085\u00c9\u000f\u0084\u00a2\u0000\u0000\u0000\u008b\u0006\u0003\u00c1P\u008dD$4P\u008bF\f\u00ff\u00d0j\u0001\u008dD$4P\u008dD$(P\u008bF\u0010\u00ff\u00d0\u008dD$\u0014P\u008dD$$P\u008bF\u0014j\u0000j\u0000\u00ff\u00d0\u008dD$ P\u008bF\u001c\u00ff\u00d0\u008b;\u0003>\u008b[\u0010\u0003\u001e\u008b\u000f\u0085\u00c9t@y\u0005\u000f\u00b7\u00c1\u00eb\u0007\u008b\u0006\u0083\u00c0\u0002\u0003\u00c1P\u008dD$,P\u008bF\f\u00ff\u00d0\u008dD$\u0018Pj\u0000\u008dD$0P\u00fft$ \u008bF\u0018\u00ff\u00d0\u008bD$\u0018\u0083\u00c7\u0004\u0089\u0003\u008b\u000f\u0083\u00c3\u0004\u0085\u00c9u\u00c0\u008b\\$\u0010\u0083\u00c3\u0014\u0089\\$\u0010\u008bK\f\u0085\u00c9\u000f\u0085^\u00ff\u00ff\u00ff\u008bD$\u001c\u008b\u000e\u008b@(j\u0000j\u0001Q\u0003\u00c1\u00ff\u00d0_^3\u00c0[\u008b\u00e5]\u00c2\u0004\u0000\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000d0020"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1082
            }
        ],
        "references": [],
        "name": "injection_write_memory"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Code injection by writing an executable or DLL to the memory of another process",
        "severity": 3,
        "marks": [
            {
                "category": "Process injection",
                "ioc": "Process 856 injected into non-child 2820",
                "type": "ioc",
                "description": null
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080\u0000\u0000\u0000\u000e\u001f\u00ba\u000e\u0000\u00b4\t\u00cd!\u00b8\u0001L\u00cd!This program cannot be run in DOS mode.\r\r\n$\u0000\u0000\u0000\u0000\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0003\u0000\fk\u00ef^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u000f!\u000b\u0001\u00022\u0000B\u0000\u0000\u0000j\u0001\u0000\u0000\u0000\u0000\u0000 \u0012\u0000\u0000\u0000\u0010\u0000\u0000\u0000`\u0000\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0001\u0000\u0000\u0002\u0000\u0000\u00c7Z\u0002\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\u0018\u0001\u0000x\u0000\u0000\u0000\u00000\u0001\u0000x\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ae\u0001\u0000@\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u001a\u0001\u0000X\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u00e1A\u0000\u0000\u0000\u0010\u0000\u0000\u0000B\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.data\u0000\u0000\u0000\\\u00c1\u0000\u0000\u0000`\u0000\u0000\u0000\u00c2\u0000\u0000\u0000D\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000h\u00a7\u0000\u0000\u00000\u0001\u0000\u0000\u00a8\u0000\u0000\u0000\u0006\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000b0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1062
            }
        ],
        "references": [],
        "name": "injection_write_memory_exe"
    },
    {
        "markcount": 1,
        "families": [],
        "description": "Expresses interest in specific running processes",
        "severity": 3,
        "marks": [
            {
                "category": "process: potential process injection target",
                "ioc": "explorer.exe",
                "type": "ioc",
                "description": null
            }
        ],
        "references": [],
        "name": "process_interest"
    },
    {
        "markcount": 2,
        "families": [],
        "description": "Resumed a suspended thread in a remote process potentially indicative of process injection",
        "severity": 3,
        "marks": [
            {
                "category": "Process injection",
                "ioc": "Process 856 resumed a thread in remote process 0",
                "type": "ioc",
                "description": null
            },
            {
                "call": {
                    "category": "process",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 6,
                    "nt_status": -1073741816,
                    "api": "NtResumeThread",
                    "return_value": 3221225508,
                    "arguments": {
                        "thread_handle": "0x000000dc",
                        "suspend_count": 220,
                        "process_identifier": 0
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1084
            }
        ],
        "references": [
            "www.endgame.com\/blog\/technical-blog\/ten-process-injection-techniques-technical-survey-common-and-trending-process"
        ],
        "name": "injection_resumethread"
    },
    {
        "markcount": 12,
        "families": [],
        "description": "Executed a process and injected code into it, probably while unpacking",
        "severity": 5,
        "marks": [
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CreateProcessInternalW",
                    "return_value": 1,
                    "arguments": {
                        "thread_identifier": 2968,
                        "thread_handle": "0x000000b8",
                        "process_identifier": 856,
                        "current_directory": "",
                        "filepath": "",
                        "track": 1,
                        "command_line": "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe \"C:\\Users\\cuck\\AppData\\Local\\Temp\\becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100.bin\" ensgJJ",
                        "filepath_r": "",
                        "stack_pivoted": 0,
                        "creation_flags": 0,
                        "process_handle": "0x000000b4",
                        "inherit_handles": 0
                    },
                    "time": 1596945190.828,
                    "tid": 2124,
                    "flags": {
                        "creation_flags": ""
                    }
                },
                "pid": 2436,
                "type": "call",
                "cid": 1051
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "CreateProcessInternalW",
                    "return_value": 1,
                    "arguments": {
                        "thread_identifier": 2952,
                        "thread_handle": "0x000000d8",
                        "process_identifier": 2820,
                        "current_directory": "",
                        "filepath": "C:\\Windows\\System32\\secinit.exe",
                        "track": 1,
                        "command_line": "C:\\ProgramData\\4b82648b808e5d3665ad\\gennt.exe",
                        "filepath_r": "C:\\Windows\\system32\\secinit.exe",
                        "stack_pivoted": 0,
                        "creation_flags": 4,
                        "process_handle": "0x000000dc",
                        "inherit_handles": 0
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {
                        "creation_flags": "CREATE_SUSPENDED"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 1055
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2820,
                        "region_size": 122880,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0x000000dc",
                        "allocation_type": 12288,
                        "base_address": "0x000b0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 1060
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtAllocateVirtualMemory",
                    "return_value": 0,
                    "arguments": {
                        "process_identifier": 2820,
                        "region_size": 4096,
                        "stack_dep_bypass": 0,
                        "stack_pivoted": 0,
                        "heap_dep_bypass": 0,
                        "protection": 64,
                        "process_handle": "0x000000dc",
                        "allocation_type": 12288,
                        "base_address": "0x000d0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {
                        "protection": "PAGE_EXECUTE_READWRITE",
                        "allocation_type": "MEM_COMMIT|MEM_RESERVE"
                    }
                },
                "pid": 856,
                "type": "call",
                "cid": 1061
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "MZ\u0090\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u00ff\u00ff\u0000\u0000\u00b8\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0080\u0000\u0000\u0000\u000e\u001f\u00ba\u000e\u0000\u00b4\t\u00cd!\u00b8\u0001L\u00cd!This program cannot be run in DOS mode.\r\r\n$\u0000\u0000\u0000\u0000\u0000\u0000\u0000PE\u0000\u0000L\u0001\u0003\u0000\fk\u00ef^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0000\u000f!\u000b\u0001\u00022\u0000B\u0000\u0000\u0000j\u0001\u0000\u0000\u0000\u0000\u0000 \u0012\u0000\u0000\u0000\u0010\u0000\u0000\u0000`\u0000\u0000\u0000\u0000@\u0000\u0000\u0010\u0000\u0000\u0000\u0002\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00e0\u0001\u0000\u0000\u0002\u0000\u0000\u00c7Z\u0002\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00004\u0018\u0001\u0000x\u0000\u0000\u0000\u00000\u0001\u0000x\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00ae\u0001\u0000@\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u001a\u0001\u0000X\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000.text\u0000\u0000\u0000\u00e1A\u0000\u0000\u0000\u0010\u0000\u0000\u0000B\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000`.data\u0000\u0000\u0000\\\u00c1\u0000\u0000\u0000`\u0000\u0000\u0000\u00c2\u0000\u0000\u0000D\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0.rsrc\u0000\u0000\u0000h\u00a7\u0000\u0000\u00000\u0001\u0000\u0000\u00a8\u0000\u0000\u0000\u0006\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u00c0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000b0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1062
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "buffer": "3bd6282b812ecdc1e609b7320ecaa5a3ac3d6d54",
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000b1000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1063
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "buffer": "3428182aaa56f2b241a34ce10316e794f6fddd49",
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000b6000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1064
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "buffer": "6ba78220f1968a855cef00ba0ece02c691fdd717",
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000c3000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1065
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "\u0000\u0000\u000b\u0000\u0000\u0000\u000b\u00004\u0018\f\u0000\u00d0\u00e1\u00bbw\u00b5\u00e6\u00bbw:\u00c4\u00bcw\u00aa\u0001\u00bcw&\u00e1\u00bbw",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000d0000"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1081
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "WriteProcessMemory",
                    "return_value": 1,
                    "arguments": {
                        "process_identifier": 2820,
                        "buffer": "U\u008b\u00ec\u0083\u00e4\u00f8\u0083\u00ec,SV\u008bu\bW\u008b\u001e\u008b~\u0004\u008bC<\u0003\u00c3\u0089D$\u001c+X4\u0083?\u0000t_\u008dG\u0004\u0089D$\u0014\u008b\u0000\u0083\u00f8\brF\u0083\u00c0\u00f8\u00d1\u00e8\u0089D$\u0010\u00ba\u0000\u0000\u0000\u0000t6\u000f\u00b7DW\b\u008b\u00c8\u00c1\u00e8\f\u0081\u00e1\u00ff\u000f\u0000\u0000\u0083\u00f8\u0003t\u0013\u0083\u00f8\nu\u0015\u008b\u0007\u0003\u0006\u0003\u00c1\u0001\u0018\u0083P\u0004\u0000\u00eb\u0007\u008b\u0007\u0003\u0006\u0001\u001c\bB;T$\u0010r\u00ca\u008bD$\u0014\u00038\u0083?\u0000u\u00a1\u008b^\b\u0089\\$\u0010\u008bK\f\u0085\u00c9\u000f\u0084\u00a2\u0000\u0000\u0000\u008b\u0006\u0003\u00c1P\u008dD$4P\u008bF\f\u00ff\u00d0j\u0001\u008dD$4P\u008dD$(P\u008bF\u0010\u00ff\u00d0\u008dD$\u0014P\u008dD$$P\u008bF\u0014j\u0000j\u0000\u00ff\u00d0\u008dD$ P\u008bF\u001c\u00ff\u00d0\u008b;\u0003>\u008b[\u0010\u0003\u001e\u008b\u000f\u0085\u00c9t@y\u0005\u000f\u00b7\u00c1\u00eb\u0007\u008b\u0006\u0083\u00c0\u0002\u0003\u00c1P\u008dD$,P\u008bF\f\u00ff\u00d0\u008dD$\u0018Pj\u0000\u008dD$0P\u00fft$ \u008bF\u0018\u00ff\u00d0\u008bD$\u0018\u0083\u00c7\u0004\u0089\u0003\u008b\u000f\u0083\u00c3\u0004\u0085\u00c9u\u00c0\u008b\\$\u0010\u0083\u00c3\u0014\u0089\\$\u0010\u008bK\f\u0085\u00c9\u000f\u0085^\u00ff\u00ff\u00ff\u008bD$\u001c\u008b\u000e\u008b@(j\u0000j\u0001Q\u0003\u00c1\u00ff\u00d0_^3\u00c0[\u008b\u00e5]\u00c2\u0004\u0000\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc\u00cc",
                        "process_handle": "0x000000dc",
                        "base_address": "0x000d0020"
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1082
            },
            {
                "call": {
                    "category": "process",
                    "status": 0,
                    "stacktrace": [],
                    "last_error": 6,
                    "nt_status": -1073741816,
                    "api": "NtResumeThread",
                    "return_value": 3221225508,
                    "arguments": {
                        "thread_handle": "0x000000dc",
                        "suspend_count": 220,
                        "process_identifier": 0
                    },
                    "time": 1596945191.10925,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1084
            },
            {
                "call": {
                    "category": "process",
                    "status": 1,
                    "stacktrace": [],
                    "api": "NtResumeThread",
                    "return_value": 0,
                    "arguments": {
                        "thread_handle": "0x00000124",
                        "suspend_count": 1,
                        "process_identifier": 856
                    },
                    "time": 1596945191.62525,
                    "tid": 2968,
                    "flags": {}
                },
                "pid": 856,
                "type": "call",
                "cid": 1265
            }
        ],
        "references": [],
        "name": "injection_runpe"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 662,
            "time": 6.2242820262908936,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 5342,
            "time": 12.22512698173523,
            "dport": 138,
            "sport": 138
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 7186,
            "time": 6.184854030609131,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 7514,
            "time": 4.15946888923645,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 7842,
            "time": 6.199009895324707,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 8170,
            "time": 4.664026975631714,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 8498,
            "time": 3.055079936981201,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 8826,
            "time": 4.6777260303497314,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 28236,
            "time": 4.192641019821167,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 36620,
            "time": 6.271647930145264,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "c653a6d9c5ac360cb66cc6e8c49ea91e79df091235c92238ae0b1871e4ccc8db",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "a5e10eac801ef700319554a756500e604ebeea3ab40dafcf4469f821a781e502",
    "irc": [],
    "https_ex": []
}

Screenshots

Screenshot from the sandboxScreenshot from the sandboxScreenshot from the sandbox

gennt.exe removal instructions

The instructions below shows how to remove gennt.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the gennt.exe file for removal, restart your computer and scan it again to verify that gennt.exe has been successfully removed. Here are the removal instructions in more detail:

  1. Download and install FreeFixer: http://www.freefixer.com/download.html
  2. Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
    Screenshot of Start Scan button
  3. When the scan is finished, locate gennt.exe in the scan result and tick the checkbox next to the gennt.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate gennt.exe in the scan result.
    Red arrow point on the unwanted file
    C:\ProgramData\2bd20eaa905c1c6a2d7d\gennt.exe
  4. Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the gennt.exe file.
    Screenshot of Fix button
  5. Restart your computer.
  6. Start FreeFixer and scan your computer again. If gennt.exe still remains in the scan result, proceed with the next step. If gennt.exe is gone from the scan result you're done.
  7. If gennt.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
  8. Restart your computer.
  9. Start FreeFixer and scan your computer again. Verify that gennt.exe no longer appear in the scan result.
Please select the option that best describe your thoughts on the removal instructions given above








Free Questionnaires

Hashes [?]

PropertyValue
MD5d7610471691672af41aec15c4880d60e
SHA256becdfa7b36f909e433d259c49b95365424bd19e91192098477fbf995c8611100

Error Messages

These are some of the error messages that can appear related to gennt.exe:

gennt.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

gennt.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

gennt.exe has stopped working.

End Program - gennt.exe. This program is not responding.

gennt.exe is not a valid Win32 application.

gennt.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with gennt.exe?

To help other users, please let us know what you will do with gennt.exe:



Comments

Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

No comments posted yet.

Leave a reply