Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 10, 2021, 5:17 p.m.	Sept. 10, 2021, 5:21 p.m.

Size	2.9MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`acce458c80680c29571dd40ced566af1`
SHA256	`5ca2a5d2ec7cee822027375ef676891f3501dad244c504807b9daa6d87cf0ac1`
CRC32	`FFD4E63E`
ssdeep	`49152:D5u6MOKaNjO2fGzlaqe38NSUgaNQrRaSKP5GeT3hSVjyGNENn18IfW0HUAV4XUq:k6MOKAjO2fQaqFNSUdNLP9Esbj86t3i5`
Yara	UPX_Zero - UPX packed file Antivirus - Contains references to security software PE_Header_Zero - PE File Signature anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) themida_packer - themida packer IsPE32 - (no description)

tlogs.exe "C:\Users\test22\AppData\Local\Temp\tlogs.exe"
1068

Name	Response	Post-Analysis Lookup
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.12.31
dimluui.ru	A 81.177.141.36	81.177.141.36

IP Address	Status	Action
185.56.175.122	Active	Moloch
104.26.13.31	Active	Moloch
164.124.101.2	Active	Moloch
185.186.142.152	Active	Moloch
81.177.141.36	Active	Moloch
51.79.249.161	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 104.26.13.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49175 -> 81.177.141.36:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49166 104.26.13.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLS 1.2 192.168.56.102:49175 81.177.141.36:443	C=US, O=Let's Encrypt, CN=R3	CN=*.dimluui.ru	3f:cc:92:e6:28:0c:55:58:a1:09:c4:33:64:7e:5c:80:a2:69:0a:04

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 10, 2021, 5:18 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 10, 2021, 5:17 p.m.			0	0
IsDebuggerPresent Sept. 10, 2021, 5:17 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052aca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052aca0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ace0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2208 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2208 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2108 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2108 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2208 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 10, 2021, 5:17 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2208 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 10, 2021, 5:17 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section
section	.themida
section	.boot

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Sept. 10, 2021, 5:17 p.m.	stacktrace: tlogs+0x409177 @ 0x1309177 tlogs+0x43408e @ 0x133408e exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 be e4 a9 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 1441464 registers.edi: 16359424 registers.eax: 1441464 registers.ebp: 1441544 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2008380459 registers.ecx: 3929276416	1
__exception__ Sept. 10, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: ed e9 09 03 00 00 c3 e9 ab e7 fe ff cf ed 6d 0f exception.symbol: tlogs+0x44ca1d exception.instruction: in eax, dx exception.module: tlogs.exe exception.exception_code: 0xc0000096 exception.offset: 4508189 exception.address: 0x134ca1d registers.esp: 1441584 registers.edi: 18808116 registers.eax: 1750617430 registers.ebp: 16359424 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 13 registers.ecx: 20	1
__exception__ Sept. 10, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: ed e9 23 4c ff ff b6 bd 00 b4 9f 0f 67 34 c1 31 exception.symbol: tlogs+0x436e0d exception.instruction: in eax, dx exception.module: tlogs.exe exception.exception_code: 0xc0000096 exception.offset: 4419085 exception.address: 0x1336e0d registers.esp: 1441584 registers.edi: 18808116 registers.eax: 1447909480 registers.ebp: 16359424 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Sept. 10, 2021, 5:17 p.m.	stacktrace: 0xe460de 0xe46034 0xe451d8 0xe44e80 0xe40070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xe461a2 registers.esp: 1438392 registers.edi: 50219064 registers.eax: 0 registers.ebp: 1438416 registers.edx: 5206408 registers.ebx: 50218348 registers.esi: 50219168 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET https://api.ip.sb/geoip
suspicious_features	GET method with no useragent header				suspicious_request	GET https://dimluui.ru/136583554.exe

Performs some HTTP requests (2 events)

request	GET https://api.ip.sb/geoip
request	GET https://dimluui.ru/136583554.exe

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

dimluui.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 246 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75674000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x770d3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75670000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a47000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 10, 2021, 5:17 p.m.	process_identifier: 1068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Foreign language identified in PE resource (3 events)

name

RT_MESSAGETABLE

language

LANG_ESTONIAN

filetype

data

sublanguage

SUBLANG_NEUTRAL

offset

0x000906fc

size

0x00002808

name

RT_VERSION

language

LANG_ESTONIAN

filetype

data

sublanguage

SUBLANG_NEUTRAL

offset

0x000930a4

size

0x00000348

name

RT_MANIFEST

language

LANG_ESTONIAN

filetype

XML 1.0 document, UTF-8 Unicode (with BOM) text

sublanguage

SUBLANG_NEUTRAL

offset

0x000933ec

size

0x00000c9b

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 10, 2021, 5:17 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00016600', u'virtual_address': u'0x00002000', u'entropy': 7.980261266418856, u'name': u' ', u'virtual_size': u'0x00030000'}

entropy

7.98026126642

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00262600', u'virtual_address': u'0x004b4000', u'entropy': 7.94208902152855, u'name': u'.boot', u'virtual_size': u'0x00262600'}

entropy

7.94208902153

description

A section with a high entropy has been found

entropy

0.865447084972

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 10, 2021, 5:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (50 out of 53 events)

Time & API	Arguments	Status
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000070c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: 7-Zip base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: AddressBook base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: Adobe AIR base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: Connection Manager base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: DirectDrawEx base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: EditPlus base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: ePageSafer base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: Fontcore base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: Google Chrome base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: IE40 base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: IE4Data base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: IE5BAKEX base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: IEData base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: MobileOptionPack base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: Office14.PROPLUS base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: SchedulingAgent base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: TouchEn nxKey base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: UnINISafeWeb base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: UnINISafeWeb6 base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: WIC base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1 base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1 base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {8941A397-4065-4F41-92CE-0EB610846EED}_is1 base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-006E-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-00A1-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {90140000-00BA-0412-0000-0000000FF1CE} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Sept. 10, 2021, 5:17 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x0000070c key_handle: 0x00000710 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1

Communicates with host for which no DNS query was performed (3 events)

host	185.56.175.122
host	185.186.142.152
host	51.79.249.161

Checks for the presence of known windows from debuggers and forensic tools (33 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:17 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 10, 2021, 5:18 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:18 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:18 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 10, 2021, 5:18 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:18 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 10, 2021, 5:18 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 10, 2021, 5:17 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Collects information about installed applications (40 events)

Time & API	Arguments	Status
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 6.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Delfino G3 (x86) version 3.6.6.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: G2BRUN regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: WIZVERA Process Manager 1,0,5,4 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Sept. 10, 2021, 5:17 p.m.	key_handle: 0x00000710 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 10, 2021, 5:17 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 10, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: ed e9 23 4c ff ff b6 bd 00 b4 9f 0f 67 34 c1 31 exception.symbol: tlogs+0x436e0d exception.instruction: in eax, dx exception.module: tlogs.exe exception.exception_code: 0xc0000096 exception.offset: 4419085 exception.address: 0x1336e0d registers.esp: 1441584 registers.edi: 18808116 registers.eax: 1447909480 registers.ebp: 16359424 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.102:49169

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Lionic	Trojan.MSIL.Reline.i!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.897307
ALYac	Gen:Variant.Razy.897307
Cylance	Unsafe
K7GW	Trojan ( 005821b31 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Razy.DDB11B
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenCBL.AWB
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Razy.897307
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:Trojan-gen
Ad-Aware	Gen:Variant.Razy.897307
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.acce458c80680c29
Emsisoft	Gen:Variant.Razy.897307 (B)
Ikarus	Trojan.Win32.Generic
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Heur!.012100A1
Microsoft	Trojan:Script/Phonzy.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	MSIL.Trojan-Stealer.Redline.WRMJO7
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R429793
McAfee	Artemis!ACCE458C8068
MAX	malware (ai score=86)
VBA32	BScope.Trojan.Startun
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
BitDefenderTheta	Gen:NN.ZexaF.34142.3A1@aKQC2SbO
AVG	Win32:Trojan-gen
MaxSecure	Trojan.Malware.300983.susgen

tlogs.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All