Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 2, 2021, 8:58 a.m.	April 2, 2021, 9:03 a.m.

Size	538.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`164551e24aa4d9ad6cb545a3d09e1348`
SHA256	`80e6030c16c508be90e4c535bbbc1bdbccdfa6438c1cac7d35b8e2067fe517d3`
CRC32	`AAAF9219`
ssdeep	`6144:mObDGn5U0EV3GbQM/UOq+ZbFN5LFv1ZW7F37RWCFACc3Np/BhII3AqrvV1aNGH9B:72C06YQCpZlB8sCwlr+NE`
PDB Path	c:\LotMiss\wavedog\FarFood\Strong.pdb
Yara	PE_Header_Zero - PE File Signature Zero Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\beiybj.zip.dll,DllRegisterServer
732
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\beiybj.zip.dll,Methodhour
2800
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\beiybj.zip.dll,
1512

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
77.220.64.146	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 2, 2021, 8:59 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 2, 2021, 8:59 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

This executable has a PDB path (1 event)

pdb_path

c:\LotMiss\wavedog\FarFood\Strong.pdb

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

One or more processes crashed (50 out of 30146 events)

Time & API	Arguments	Status
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618500 registers.edi: 3222648 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 10946512 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 10946528 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 10946544 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 10946560 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 10946576 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 10946592 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 10946608 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 10946624 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 10946640 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 10946656 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10946672 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 10946688 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 10946704 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 10946720 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 10946736 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618476 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 10946752 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: DllRegisterServer+0xcbc7 beiybj+0x16937 @ 0x73c86937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2617672 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 2618744 registers.edx: 23 registers.ebx: 2618760 registers.esi: 23 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618728 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 10949992 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 10950016 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 10950040 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 10950064 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 10950088 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 10950112 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 10950136 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 10950160 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 10950184 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 10950208 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 10950232 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 10950256 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 10950280 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 10950304 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 10950328 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618704 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 10950352 registers.ecx: 0	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: rundll32+0x1326 @ 0x611326 rundll32+0x1901 @ 0x611901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: cc c3 33 c0 a3 b5 b1 ca 73 a3 ad b1 ca 73 a3 b1 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer-0x4bf5 beiybj+0x517b exception.address: 0x73c7517b registers.esp: 2620036 registers.edi: 0 registers.eax: 1971153576 registers.ebp: 2620688 registers.edx: 101 registers.ebx: 0 registers.esi: 655942 registers.ecx: 11	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2619988 registers.edi: 0 registers.eax: 2000478246 registers.ebp: 2620284 registers.edx: 1 registers.ebx: 10240 registers.esi: 10240 registers.ecx: 10949992	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 c3 0f 1f 80 00 00 00 00 0f 1f 80 00 00 00 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x735f beiybj+0x110cf exception.address: 0x73c810cf registers.esp: 2619972 registers.edi: 10951544 registers.eax: 2000478085 registers.ebp: 2620284 registers.edx: 112 registers.ebx: 10240 registers.esi: 10240 registers.ecx: 11	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2619184 registers.edi: 0 registers.eax: 2000478246 registers.ebp: 2619940 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 10949992	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2619184 registers.edi: 0 registers.eax: 2000478246 registers.ebp: 2619948 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 10949992	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: DllRegisterServer+0xcf0f beiybj+0x16c7f @ 0x73c86c7f exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618744 registers.edi: 0 registers.eax: 2000478246 registers.ebp: 2619224 registers.edx: 0 registers.ebx: 0 registers.esi: 169797019 registers.ecx: 10949992	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: DllRegisterServer+0xcf0f beiybj+0x16c7f @ 0x73c86c7f exception.instruction_r: cc c3 8b 3d f0 b1 ca 73 8b 74 24 20 8b 54 24 18 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x9c8a beiybj+0x139fa exception.address: 0x73c839fa registers.esp: 2618764 registers.edi: 2618788 registers.eax: 1970477797 registers.ebp: 2619224 registers.edx: 87 registers.ebx: 0 registers.esi: 1970405376 registers.ecx: 13	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: DllRegisterServer+0xcf0f beiybj+0x16c7f @ 0x73c86c7f exception.instruction_r: cc c3 e9 14 f9 ff ff 8b 44 10 14 85 c0 75 e9 eb exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xb259 beiybj+0x14fc9 exception.address: 0x73c84fc9 registers.esp: 2618700 registers.edi: 11045184 registers.eax: 1970475456 registers.ebp: 2619224 registers.edx: 114 registers.ebx: 1970405376 registers.esi: 1970405376 registers.ecx: 12	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec beiybj+0x1105c exception.address: 0x73c8105c registers.esp: 2618652 registers.edi: 11045184 registers.eax: 2000478246 registers.ebp: 2618700 registers.edx: 1 registers.ebx: 316 registers.esi: 320 registers.ecx: 10949992	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 c3 0f 1f 80 00 00 00 00 0f 1f 80 00 00 00 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x735f beiybj+0x110cf exception.address: 0x73c810cf registers.esp: 2618636 registers.edi: 11045240 registers.eax: 2000478085 registers.ebp: 2618700 registers.edx: 0 registers.ebx: 316 registers.esi: 320 registers.ecx: 10949992	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 85 c0 0f 85 dd 00 00 00 45 3b 2e 0f 82 76 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xadb8 beiybj+0x14b28 exception.address: 0x73c84b28 registers.esp: 2618692 registers.edi: 11045184 registers.eax: 1967472907 registers.ebp: 0 registers.edx: 100 registers.ebx: 1967390720 registers.esi: 11045240 registers.ecx: 8	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 85 c0 0f 85 dd 00 00 00 45 3b 2e 0f 82 76 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xadb8 beiybj+0x14b28 exception.address: 0x73c84b28 registers.esp: 2618692 registers.edi: 11045184 registers.eax: 1967472907 registers.ebp: 1 registers.edx: 10949992 registers.ebx: 0 registers.esi: 11045240 registers.ecx: 10	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 85 c0 0f 85 dd 00 00 00 45 3b 2e 0f 82 76 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xadb8 beiybj+0x14b28 exception.address: 0x73c84b28 registers.esp: 2618692 registers.edi: 11045184 registers.eax: 1967472907 registers.ebp: 2 registers.edx: 10949992 registers.ebx: 0 registers.esi: 11045240 registers.ecx: 10	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 85 c0 0f 85 dd 00 00 00 45 3b 2e 0f 82 76 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xadb8 beiybj+0x14b28 exception.address: 0x73c84b28 registers.esp: 2618692 registers.edi: 11045184 registers.eax: 1967472907 registers.ebp: 3 registers.edx: 10949992 registers.ebx: 0 registers.esi: 11045240 registers.ecx: 10	1
__exception__ April 2, 2021, 8:59 a.m.	stacktrace: exception.instruction_r: cc c3 8d 0c 24 e8 69 48 01 00 80 7c 24 2c 00 74 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xaf2d beiybj+0x14c9d exception.address: 0x73c84c9d registers.esp: 2618696 registers.edi: 11045184 registers.eax: 1967472942 registers.ebp: 1967390720 registers.edx: 100 registers.ebx: 3267680 registers.esi: 1970405376 registers.ecx: 7	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST https://77.220.64.146/

Performs some HTTP requests (1 event)

request

POST https://77.220.64.146/

Sends data using the HTTP POST Method (1 event)

request

POST https://77.220.64.146/

Allocates read-write-execute memory (usually to unpack itself) (26 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cba000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ccb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73702000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cba000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:58 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 2800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ccb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 2800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 2, 2021, 8:59 a.m.	process_identifier: 2800 region_size: 557056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Queries for potentially installed applications (50 out of 65 events)

Time & API	Arguments	Status
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: 7-Zip base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: AddressBook base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: Connection Manager base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: DirectDrawEx base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: Fontcore base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: HashTab base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: IE40 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: IE4Data base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: IE5BAKEX base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: IEData base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: MobileOptionPack base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: SchedulingAgent base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: WIC base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F86417051FF} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86417051FF}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-0028-0412-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-1000-0000000FF1CE}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-002A-0000-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0000-1000-0000000FF1CE}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-002A-0409-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0409-1000-0000000FF1CE}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-002A-0412-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0412-1000-0000000FF1CE}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: AddressBook base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: Connection Manager base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: EditPlus base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: ENTERPRISE base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: Fontcore base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: Google Chrome base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: IE40 base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: IE4Data base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: IEData base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: WIC base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW April 2, 2021, 8:59 a.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1

Communicates with host for which no DNS query was performed (1 event)

host

77.220.64.146

Collects information about installed applications (41 events)

Time & API	Arguments	Status
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 19.00 (x64) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HashTab 6.0.0.34 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 7 Update 51 (64-bit) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86417051FF}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 KOR Language Pack regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 x64 Minimum Runtime - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Office 64-bit Components 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0000-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared 64-bit MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0409-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared 64-bit MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0412-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 한국어 언어 팩 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Python 2.7.18 (64-bit) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 x64 Additional Runtime - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW April 2, 2021, 8:59 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (1 event)

Time & API	Arguments	Status	Return	Repeated
CryptHashData April 2, 2021, 8:59 a.m.	buffer: TEST22-PCtest22f¦rZ hash_handle: 0x00328a50 flags: 0	1	1	0

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.Dridex.735
Cynet	Malicious (score: 100)
FireEye	Generic.mg.164551e24aa4d9ad
CAT-QuickHeal	Trojan.Multi
McAfee	RDN/Dridex
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2923328
Sangfor	Trojan.Win32.Cridex.gen
K7AntiVirus	Trojan ( 005789a61 )
Alibaba	TrojanDownloader:Win32/Dridex.2d1add29
K7GW	Trojan ( 005789a61 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Zusy.D5A436
Cyren	W32/Trojan.DJSJ-0808
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HJSK
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan-Downloader.Win32.Cridex.gen
BitDefender	Gen:Variant.Zusy.369718
NANO-Antivirus	Trojan.Win32.Cridex.intxuh
Paloalto	generic.ml
MicroWorld-eScan	Gen:Variant.Zusy.369718
Tencent	Malware.Win32.Gencirc.11bb2dde
Ad-Aware	Gen:Variant.Zusy.369718
Sophos	Mal/Generic-R + Troj/Dridex-AFA
Comodo	Malware@#2jd0bsf6spf1w
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_FRS.0NA103C321
McAfee-GW-Edition	RDN/Dridex
Emsisoft	Trojan.Agent (A)
Ikarus	Trojan.Win32.Crypt
Jiangmin	TrojanDownloader.Cridex.aeh
Webroot	W32.Malware.Gen
Avira	TR/AD.Dridex.onksh
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win32.Downloader.oa
Microsoft	Trojan:Win32/Dridex.NS!MTB
AegisLab	Trojan.Win32.Cridex.a!c
GData	Gen:Variant.Zusy.369718
AhnLab-V3	Malware/Gen.Reputation.C4357419
VBA32	TrojanDownloader.Cridex
ALYac	Gen:Variant.Zusy.369718
MAX	malware (ai score=86)
Malwarebytes	Trojan.Crypt
TrendMicro-HouseCall	TROJ_FRS.0NA103C321
Rising	Downloader.Cridex!8.F70 (CLOUD)
Yandex	Trojan.Kryptik!nDWliVXQtYA
Fortinet	W32/PossibleThreat
MaxSecure	Trojan.Malware.74221143.susgen

beiybj.zip

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All