Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 4, 2021, 1:54 p.m.	Sept. 4, 2021, 2 p.m.

Size	3.5MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`7dd46656a988d8b05cf41486ff90e6aa`
SHA256	`559cf45c1df3cb20c47fb4a9dda11d5f550471f3063bfd79883e98aed990aaf1`
CRC32	`5144A02F`
ssdeep	`49152:Pcw/P3vIldH0fqaMSGNJ+51Fd0u0+jNb3XGIgrsmUbzhNC75:PtvqdKte+bFdn0+jNboUJNCd`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) themida_packer - themida packer IsPE32 - (no description)

rp1.exe "C:\Users\test22\AppData\Local\Temp\rp1.exe"
1080
- update.exe "C:\Users\test22\AppData\Local\Temp\update.exe"
  1292
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
bitbucket.org	A 104.192.141.1	104.192.141.1
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	172.67.75.172
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.133.233
iplogger.org	A 88.99.66.31	88.99.66.31

IP Address	Status	Action
104.192.141.1	Active	Moloch
162.159.129.233	Active	Moloch
164.124.101.2	Active	Moloch
172.67.75.172	Active	Moloch
84.246.85.14	Active	Moloch
88.99.66.31	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49203 -> 172.67.75.172:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49226 -> 162.159.129.233:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.192.141.1:443 -> 192.168.56.101:49234	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49234 -> 104.192.141.1:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.192.141.1:443 -> 192.168.56.101:49235	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 104.192.141.1:443 -> 192.168.56.101:49237	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49237 -> 104.192.141.1:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49231 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.192.141.1:443 -> 192.168.56.101:49232	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49232 -> 104.192.141.1:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 104.192.141.1:443 -> 192.168.56.101:49239	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 104.192.141.1:443 -> 192.168.56.101:49238	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49238 -> 104.192.141.1:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49203 172.67.75.172:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLS 1.2 192.168.56.101:49226 162.159.129.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	54:e1:a7:9d:cc:c8:60:86:f1:a5:da:74:0e:5a:ab:45:df:37:8a:78
TLSv1 192.168.56.101:49231 88.99.66.31:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.iplogger.org	55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 4, 2021, 1:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 4, 2021, 1:55 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 4, 2021, 1:54 p.m.			0	0
IsDebuggerPresent Sept. 4, 2021, 1:54 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA Sept. 4, 2021, 1:55 p.m.	buffer: failed to open: C:\ProgramData\Data\GPU.zip console_handle: 0x00000007	1	1	0
WriteConsoleA Sept. 4, 2021, 1:55 p.m.	buffer: failed to open: C:\ProgramData\Systemd\CPU.zip console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e276a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e276a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00e276e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00ebc7a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00ebc7a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00ebc668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00ebc668 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00ebc7a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 4, 2021, 1:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00ebc7a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 4, 2021, 1:54 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.themida
section	.boot

One or more processes crashed (16 events)

Time & API	Arguments	Status
__exception__ Sept. 4, 2021, 1:54 p.m.	stacktrace: rp1+0x461191 @ 0x801191 rp1+0x474977 @ 0x814977 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 49 3a ac 89 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 3668860 registers.edi: 5382144 registers.eax: 3668860 registers.ebp: 3668940 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2000778283 registers.ecx: 4048093184	1
__exception__ Sept. 4, 2021, 1:54 p.m.	stacktrace: exception.instruction_r: ed e9 78 01 00 00 ee 7f ff ff 93 22 65 61 00 86 exception.symbol: rp1+0x4955b9 exception.instruction: in eax, dx exception.module: rp1.exe exception.exception_code: 0xc0000096 exception.offset: 4806073 exception.address: 0x8355b9 registers.esp: 3668980 registers.edi: 6985621 registers.eax: 1750617430 registers.ebp: 5382144 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Sept. 4, 2021, 1:54 p.m.	stacktrace: exception.instruction_r: ed e9 9d 95 06 00 c3 e9 7f b1 07 00 7f c3 0a 00 exception.symbol: rp1+0x41003f exception.instruction: in eax, dx exception.module: rp1.exe exception.exception_code: 0xc0000096 exception.offset: 4259903 exception.address: 0x7b003f registers.esp: 3668980 registers.edi: 6985621 registers.eax: 1447909480 registers.ebp: 5382144 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Sept. 4, 2021, 1:54 p.m.	stacktrace: 0xf16113 0xf15fef 0xf15130 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 11 83 3d 6c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xf161cf registers.esp: 3665728 registers.edi: 51267364 registers.eax: 0 registers.ebp: 3665752 registers.edx: 14648952 registers.ebx: 51268080 registers.esi: 51268184 registers.ecx: 0	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x6981a47 0x6981989 0x69816b2 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665460 registers.edi: 2 registers.eax: 0 registers.ebp: 3665516 registers.edx: 95473008 registers.ebx: 0 registers.esi: 51873348 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x6981a47 0x6981989 0x69816b2 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665460 registers.edi: 2 registers.eax: 0 registers.ebp: 3665516 registers.edx: 95473008 registers.ebx: 0 registers.esi: 52839852 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x6981a47 0x6981989 0x69816b2 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665460 registers.edi: 2 registers.eax: 0 registers.ebp: 3665516 registers.edx: 95473008 registers.ebx: 0 registers.esi: 53793444 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x6984046 0x6983f99 0x6981727 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665452 registers.edi: 2 registers.eax: 0 registers.ebp: 3665508 registers.edx: 95473008 registers.ebx: 0 registers.esi: 54746104 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x6984046 0x6983f99 0x6981727 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665452 registers.edi: 2 registers.eax: 0 registers.ebp: 3665508 registers.edx: 95473008 registers.ebx: 0 registers.esi: 51354796 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x6984046 0x6983f99 0x6981727 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665452 registers.edi: 2 registers.eax: 0 registers.ebp: 3665508 registers.edx: 95473008 registers.ebx: 0 registers.esi: 52318732 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x69845b7 0x6984509 0x698179c 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665456 registers.edi: 2 registers.eax: 0 registers.ebp: 3665512 registers.edx: 95473008 registers.ebx: 0 registers.esi: 53282760 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x69845b7 0x6984509 0x698179c 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665456 registers.edi: 2 registers.eax: 0 registers.ebp: 3665512 registers.edx: 95473008 registers.ebx: 0 registers.esi: 54299216 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x69845b7 0x6984509 0x698179c 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665456 registers.edi: 2 registers.eax: 0 registers.ebp: 3665512 registers.edx: 95473008 registers.ebx: 0 registers.esi: 55315672 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x69849f9 0x6984949 0x698180d 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665452 registers.edi: 2 registers.eax: 0 registers.ebp: 3665508 registers.edx: 95473008 registers.ebx: 0 registers.esi: 56332208 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x69849f9 0x6984949 0x698180d 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665452 registers.edi: 2 registers.eax: 0 registers.ebp: 3665508 registers.edx: 95473008 registers.ebx: 0 registers.esi: 51147580 registers.ecx: 95473568	1
__exception__ Sept. 4, 2021, 1:55 p.m.	stacktrace: 0x69849f9 0x6984949 0x698180d 0x6981161 0xf197df 0xf151af 0xf14e50 0xf10075 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 exception.instruction_r: 8b 40 04 89 45 d8 c7 45 e4 00 00 00 00 c7 45 e8 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x6981e48 registers.esp: 3665452 registers.edi: 2 registers.eax: 0 registers.ebp: 3665508 registers.edx: 95473008 registers.ebx: 0 registers.esi: 52166288 registers.ecx: 95473568	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET https://api.ip.sb/geoip
suspicious_features	GET method with no useragent header				suspicious_request	GET https://cdn.discordapp.com/attachments/446310284857180160/883361400209174538/Zenare.exe

Performs some HTTP requests (4 events)

request	GET http://iplogger.org/1mxPf7
request	GET https://api.ip.sb/geoip
request	GET https://cdn.discordapp.com/attachments/446310284857180160/883361400209174538/Zenare.exe
request	GET https://iplogger.org/1mxPf7

Allocates read-write-execute memory (usually to unpack itself) (50 out of 248 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75753000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75758000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757ae000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75755000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75483000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7574a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75734000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7575c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a88000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757af000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75735000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a7c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 4, 2021, 1:54 p.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75733000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

update.exe tried to sleep 136 seconds, actually delayed analysis time by 136 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 4, 2021, 1:55 p.m.	total_number_of_free_bytes: 13710299136 free_bytes_available: 13710299136 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk
file	C:\Users\test22\AppData\Local\Temp\update.exe

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\update.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\update.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (7 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x00000574 process_name: pw.exe process_identifier: 3060	1	1
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x00000574 process_name: taskhost.exe process_identifier: 2832	1	1
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x00000574 process_name: WmiPrvSE.exe process_identifier: 1452	1	1
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x00000574 process_name: update.exe process_identifier: 1292	1	1
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x00000574 process_name: conhost.exe process_identifier: 2948	1	1
Process32NextW Sept. 4, 2021, 1:56 p.m.	snapshot_handle: 0x00000568 process_name: cmd.exe process_identifier: 2824	1	1
Process32NextW Sept. 4, 2021, 1:56 p.m.	snapshot_handle: 0x00000568 process_name: conhost.exe process_identifier: 1828	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 4, 2021, 1:54 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00018c00', u'virtual_address': u'0x00002000', u'entropy': 7.984057064341566, u'name': u' ', u'virtual_size': u'0x00032000'}

entropy

7.98405706434

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00213200', u'virtual_address': u'0x00506000', u'entropy': 7.9394589273694525, u'name': u'.boot', u'virtual_size': u'0x00213200'}

entropy

7.93945892737

description

A section with a high entropy has been found

entropy

0.627309916772

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 4, 2021, 1:55 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 153 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005b8 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005bc process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005bc process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0
Process32NextW Sept. 4, 2021, 1:55 p.m.	snapshot_handle: 0x000005d0 process_name: conhost.exe process_identifier: 2948		0	0

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000023c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: AddressBook base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: Connection Manager base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: DirectDrawEx base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: EditPlus base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: ENTERPRISE base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: Fontcore base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: Google Chrome base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: IE40 base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: IE4Data base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: IE5BAKEX base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: IEData base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: MobileOptionPack base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: SchedulingAgent base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: WIC base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW Sept. 4, 2021, 1:55 p.m.	regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x0000023c key_handle: 0x00000644 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Communicates with host for which no DNS query was performed (1 event)

host

84.246.85.14

Checks for the presence of known windows from debuggers and forensic tools (50 out of 57 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:54 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 4, 2021, 1:55 p.m.	class_name: Filemonclass window_name:		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 4, 2021, 1:54 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Sept. 4, 2021, 1:55 p.m.	key_handle: 0x00000644 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Elastic	malicious (high confidence)
Cylance	Unsafe
Cybereason	malicious.7c43ae
APEX	Malicious
Paloalto	generic.ml
Kaspersky	VHO:Trojan-PSW.MSIL.Reline.gen
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Rising	Trojan.Generic@ML.87 (RDML:65q9taaW0aHzSMH9nhhqnA)
FireEye	Generic.mg.7dd46656a988d8b0
SentinelOne	Static AI - Suspicious PE
Gridinsoft	Trojan.Heur!.012100A1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R429793
VBA32	BScope.Backdoor.MSIL.Noancooe
Ikarus	Trojan.Win32.Generic

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 4, 2021, 1:54 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 4, 2021, 1:54 p.m.	stacktrace: exception.instruction_r: ed e9 9d 95 06 00 c3 e9 7f b1 07 00 7f c3 0a 00 exception.symbol: rp1+0x41003f exception.instruction: in eax, dx exception.module: rp1.exe exception.exception_code: 0xc0000096 exception.offset: 4259903 exception.address: 0x7b003f registers.esp: 3668980 registers.edi: 6985621 registers.eax: 1447909480 registers.ebp: 5382144 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

rp1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All