Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 14, 2021, 9:54 a.m.	Sept. 14, 2021, 10:06 a.m.

Size	2.7MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`a8ea59af5d4d2b6d07e62e9e26b9259d`
SHA256	`d848ad80c61b73f73f41e7f0f17b0eb53a70c4118450c1cf68210c592b289174`
CRC32	`8C8DA8D8`
ssdeep	`49152:iG+8n3QbxDgpgx2LWzmidNCFaj9V3QEaat3M7YW+Ju92N2b/B/7DNZl7bl+2f:D+8ngbxDgpgMLWzmidNCkjInU3MKEgI5`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check anti_vm_detect - Possibly employs anti-virtualization techniques Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library themida_packer - themida packer IsPE32 - (no description)

qu2.exe "C:\Users\test22\AppData\Local\Temp\qu2.exe"
2496

Name	Response	Post-Analysis Lookup
sherence.ru	A 172.67.176.114 A 104.21.48.37	104.21.48.37
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.12.31

IP Address	Status	Action
104.26.12.31	Active	Moloch
164.124.101.2	Active	Moloch
172.67.176.114	Active	Moloch
45.129.236.209	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 104.26.12.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 172.67.176.114:80 -> 192.168.56.102:49179	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 172.67.176.114:80 -> 192.168.56.102:49179	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49166 104.26.12.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 14, 2021, 9:54 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 14, 2021, 9:54 a.m.			0	0
IsDebuggerPresent Sept. 14, 2021, 9:54 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00588758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00588758 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00588398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x074c1f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x074c1f48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x074c1e48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x074c21c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x074c2288 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 14, 2021, 9:54 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x074c2288 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 14, 2021, 9:54 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	.vm_sec
section	.themida
section	.boot

The file contains an unknown PE resource name possibly indicative of a packer (4 events)

resource name	HIDEWIN
resource name	MUI
resource name	REGINST
resource name	SRSICON

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Sept. 14, 2021, 9:54 a.m.	stacktrace: qu2+0x3e6f95 @ 0xd96f95 qu2+0x3e416d @ 0xd9416d exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 3f db 4a 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 4520464 registers.edi: 11526144 registers.eax: 4520464 registers.ebp: 4520544 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2008380459 registers.ecx: 3864723456	1
__exception__ Sept. 14, 2021, 9:54 a.m.	stacktrace: exception.instruction_r: ed e9 d9 25 ff ff c3 e9 9f 26 ff ff 13 82 0a 00 exception.symbol: qu2+0x41d800 exception.instruction: in eax, dx exception.module: qu2.exe exception.exception_code: 0xc0000096 exception.offset: 4315136 exception.address: 0xdcd800 registers.esp: 4520584 registers.edi: 12612410 registers.eax: 1750617430 registers.ebp: 11526144 registers.edx: 22614 registers.ebx: 2147483650 registers.esi: 11888662 registers.ecx: 20	1
__exception__ Sept. 14, 2021, 9:54 a.m.	stacktrace: exception.instruction_r: ed e9 45 2b 00 00 d0 68 fb 97 fc 69 01 00 8b 21 exception.symbol: qu2+0x418aeb exception.instruction: in eax, dx exception.module: qu2.exe exception.exception_code: 0xc0000096 exception.offset: 4295403 exception.address: 0xdc8aeb registers.esp: 4520584 registers.edi: 12612410 registers.eax: 1447909480 registers.ebp: 11526144 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 11888662 registers.ecx: 10	1
__exception__ Sept. 14, 2021, 9:54 a.m.	stacktrace: 0x271baed 0x271ba3e 0x27169b8 0x27166f1 0x2714e50 0x2710076 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 1b eb 13 83 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x271bb8a registers.esp: 4517412 registers.edi: 49401300 registers.eax: 0 registers.ebp: 4517436 registers.edx: 5617912 registers.ebx: 49400648 registers.esi: 49401468 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://sherence.ru/qYnjfKljhYhAhBx.exe
suspicious_features	GET method with no useragent header				suspicious_request	GET https://api.ip.sb/geoip

Performs some HTTP requests (2 events)

request	GET http://sherence.ru/qYnjfKljhYhAhBx.exe
request	GET https://api.ip.sb/geoip

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

sherence.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 252 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a47000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7567b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7567b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76abf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a63000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a68000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76abe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a65000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75670000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 14, 2021, 9:54 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

qu2.exe tried to sleep 134 seconds, actually delayed analysis time by 134 seconds

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\qYnjfKljhYhAhBx.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\qYnjfKljhYhAhBx.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\qYnjfKljhYhAhBx.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 14, 2021, 9:54 a.m.	flags: 15 family: 0		111	0

An executable file was downloaded by the process qu2.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
recv Sept. 14, 2021, 9:54 a.m.	buffer: HTTP/1.1 200 OK Date: Tue, 14 Sep 2021 01:04:20 GMT Content-Type: application/x-msdos-program Content-Length: 11462144 Connection: keep-alive last-modified: Mon, 13 Sep 2021 22:09:34 GMT etag: "aee600-5cbe7b8567ff2" Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PGx3MpTVZ0fTb4NYp0E3N6aJeRQcpeO5BmnuhbYRoMh%2B14toRWyaEAWZwdg4o0kTR2W8zU%2Bg7cLGrPXN8z2kTp7uJF65t0vAASYcbl6%2FzEbD3OZ5LoF%2BvbhMOtK8rA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 68e5b355ce950a72-KIX alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL6¶à0Ü®û® ¯@ @¯@4û®W¯ ¯ H.textÛ® Ü® `.rsrc¯Þ®@@.reloc ¯ä®@Bpû®HÓ¬$(¸\|ºª ¿ëVûÍ;²$0¥xC=VDÒb¹ÔñçæÃ9ALÌ,¬lì\Ü<¼\|üBÂ"¢bâRÒ2²rò JÊ*ªjêZÚ:ºzúFÆ&¦fæVÖ6¶vöNÎ.®nî^Þ>¾~þAÁ!¡aáQÑ1±qñ IÉ)©iéYÙ9¹yùEÅ%¥eåUÕ5µuõ MÍ-mí]Ý=½}ý S S Ó Ó 3 3 ³ ³ s s ó ó K K Ë Ë + + « « k k ë ë [ [ Û Û ; ; » » { { û û G G Ç Ç ' ' § § g g ç ç W W × × 7 7 · · w w ÷ ÷ O O Ï Ï / / ¯ ¯ o o ï ï _ _ ß ß ? ? ¿ ¿ ÿ ÿ @ `P0pH(hX8xD$dT4tCÃ#£cã received: 2920 socket: 1864	1	2920	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00018c00', u'virtual_address': u'0x00002000', u'entropy': 7.985300906489977, u'name': u' ', u'virtual_size': u'0x00034000'}

entropy

7.98530090649

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00000800', u'virtual_address': u'0x00036000', u'entropy': 7.866552887307077, u'name': u' ', u'virtual_size': u'0x000012dc'}

entropy

7.86655288731

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00190000', u'virtual_address': u'0x0043c000', u'entropy': 7.957382545651425, u'name': u'.boot', u'virtual_size': u'0x00190000'}

entropy

7.95738254565

description

A section with a high entropy has been found

entropy

0.608260325407

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 14, 2021, 9:54 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (50 out of 53 events)

Time & API	Arguments	Status
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000274 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: 7-Zip base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: AddressBook base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: Adobe AIR base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: Connection Manager base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: EditPlus base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: ePageSafer base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: Fontcore base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: Google Chrome base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: IE40 base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: IE4Data base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: IEData base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: Office14.PROPLUS base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: TouchEn nxKey base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: UnINISafeWeb base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: UnINISafeWeb6 base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: WIC base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1 base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1 base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {8941A397-4065-4F41-92CE-0EB610846EED}_is1 base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-006E-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-00A1-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {90140000-00BA-0412-0000-0000000FF1CE} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Sept. 14, 2021, 9:54 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000274 key_handle: 0x00000248 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1

Communicates with host for which no DNS query was performed (1 event)

host

45.129.236.209

Checks for the presence of known windows from debuggers and forensic tools (50 out of 99 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 14, 2021, 9:54 a.m.	class_name: Filemonclass window_name:		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 14, 2021, 9:54 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Executes one or more WMI queries (4 events)

wmi	SELECT * FROM AntivirusProduct
wmi	SELECT * FROM AntiSpyWareProduct
wmi	SELECT * FROM FirewallProduct
wmi	SELECT * FROM Win32_Process Where SessionId='1'

Collects information about installed applications (40 events)

Time & API	Arguments	Status
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 6.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Delfino G3 (x86) version 3.6.6.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: G2BRUN regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: WIZVERA Process Manager 1,0,5,4 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Sept. 14, 2021, 9:54 a.m.	key_handle: 0x00000248 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 14, 2021, 9:54 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 14, 2021, 9:54 a.m.	stacktrace: exception.instruction_r: ed e9 45 2b 00 00 d0 68 fb 97 fc 69 01 00 8b 21 exception.symbol: qu2+0x418aeb exception.instruction: in eax, dx exception.module: qu2.exe exception.exception_code: 0xc0000096 exception.offset: 4295403 exception.address: 0xdc8aeb registers.esp: 4520584 registers.edi: 12612410 registers.eax: 1447909480 registers.ebp: 11526144 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 11888662 registers.ecx: 10	1	0	0

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
FireEye	Generic.mg.a8ea59af5d4d2b6d
Cylance	Unsafe
Cybereason	malicious.3cb6d0
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.Themida.HYO
Paloalto	generic.ml
Kaspersky	VHO:Trojan-PSW.Win32.Stealer.gen
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
APEX	Malicious
Sophos	Generic ML PUA (PUA)
Emsisoft	Trojan.Agent (A)
Gridinsoft	Trojan.Heur!.032104A1
Microsoft	Trojan:Win32/Tnega!ml
GData	MSIL.Trojan-Stealer.Redline.G26PQ0
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R429793
VBA32	BScope.Trojan.MSIL.Inject
Malwarebytes	Spyware.PasswordStealer
Avast	FileRepMalware
Rising	Trojan.Generic@ML.98 (RDML:BzODpMwkALkdM6em01JSvQ)
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_80% (W)

qu2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All