Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 25, 2021, 10:56 a.m.	Sept. 25, 2021, 11:06 a.m.

Size	441.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6200236a6524e95a6636191b403a4f3d`
SHA256	`14f35f0cd672f0dbb8eb4c3888fd6407897c3f7307ad7ad57b949a0c7c11ab81`
CRC32	`7B6BA985`
ssdeep	`12288:inI+2lHyqL1LChjZonnMqjSmm1if1cH3T:P/Hyq08nM0Sr+1k3T`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

file6.exe "C:\Users\test22\AppData\Local\Temp\file6.exe"
2472
- RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  1644
  - clipper)).exe "C:\Users\test22\AppData\Local\Temp\clipper)).exe"
    808
    - cmd.exe "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
      1904
      - schtasks.exe schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Local\Temp\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
        1632
  - 1.exe "C:\Users\test22\AppData\Local\Temp\1.exe"
    2324

Name	Response	Post-Analysis Lookup
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.12.31

IP Address	Status	Action
104.26.13.31	Active	Moloch
164.124.101.2	Active	Moloch
65.21.236.62	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49173 -> 104.26.13.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49173 104.26.13.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9

Queries for the computername (14 events)

Time & API	Arguments	Status	Return
GetComputerNameA Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 25, 2021, 10:56 a.m.			0	0
IsDebuggerPresent Sept. 25, 2021, 10:56 a.m.			0	0
IsDebuggerPresent Sept. 25, 2021, 10:56 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 25, 2021, 10:56 a.m.	buffer: SUCCESS: The scheduled task "MyApp" has successfully been created. console_handle: 0x00000007	1	1	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00736000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00736000 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00736080 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d1da8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d1da8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d1ca8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d1ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d1f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2021, 10:56 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x007d1f68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 25, 2021, 10:56 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

One or more processes crashed (50 out of 74 events)

Time & API	Arguments	Status
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 10 eb 02 a0 8c 64 8f 00 eb 04 85 8f 72 51 83 exception.symbol: file6+0x55060 exception.instruction: mov edx, dword ptr [eax] exception.module: file6.exe exception.exception_code: 0xc0000005 exception.offset: 348256 exception.address: 0xc05060 registers.esp: 1898520 registers.edi: 0 registers.eax: 0 registers.ebp: 1898540 registers.edx: 12603392 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 00 eb 03 c8 e4 7e 64 8f 00 eb 02 28 8e 83 c4 exception.symbol: file6+0x55c57 exception.instruction: mov eax, dword ptr [eax] exception.module: file6.exe exception.exception_code: 0xc0000005 exception.offset: 351319 exception.address: 0xc05c57 registers.esp: 1898488 registers.edi: 0 registers.eax: 0 registers.ebp: 1898540 registers.edx: 4294901775 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: exception.instruction_r: 8b 0a eb 02 ba dd 90 eb 03 02 97 dc e9 2f 05 00 exception.symbol: file6+0x57717 exception.instruction: mov ecx, dword ptr [edx] exception.module: file6.exe exception.exception_code: 0xc0000005 exception.offset: 358167 exception.address: 0xc07717 registers.esp: 1898488 registers.edi: 12688372 registers.eax: 0 registers.ebp: 4293649643 registers.edx: 0 registers.ebx: 8388608 registers.esi: 12604959 registers.ecx: 60796	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: exception.instruction_r: 0f 0b eb 03 09 bc 34 0f 0b eb 02 63 66 e9 e2 00 exception.symbol: file6+0x57a77 exception.instruction: ud2 exception.module: file6.exe exception.exception_code: 0xc000001d exception.offset: 359031 exception.address: 0xc07a77 registers.esp: 1898488 registers.edi: 8847360 registers.eax: 1256776847 registers.ebp: 4293649643 registers.edx: 8847360 registers.ebx: 8388608 registers.esi: 8847756 registers.ecx: 0	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: file6+0x57957 @ 0xc07957 exception.instruction_r: 0f 0b eb 05 8c 95 71 ab 5f 0f 0b eb 01 a3 eb 03 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x875700 registers.esp: 1898152 registers.edi: 8409560 registers.eax: 0 registers.ebp: 1898468 registers.edx: 12613074 registers.ebx: 8847756 registers.esi: 4293712584 registers.ecx: 235	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x77b26ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77b26a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x74b0482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77af0143 file6+0x57957 @ 0xc07957 exception.instruction_r: f7 f0 eb 04 f3 c6 d7 0e eb 04 8c bc 38 01 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x875894 registers.esp: 1896360 registers.edi: 0 registers.eax: 0 registers.ebp: 1896376 registers.edx: 12613074 registers.ebx: 8869919 registers.esi: 0 registers.ecx: 1897028	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: exception.instruction_r: 0f 0b eb 03 be df ed 0f 0b eb 01 89 e9 36 fc ff exception.symbol: file6+0x59b27 exception.instruction: ud2 exception.module: file6.exe exception.exception_code: 0xc000001d exception.offset: 367399 exception.address: 0xc09b27 registers.esp: 1898488 registers.edi: 8438508 registers.eax: 92 registers.ebp: 4293655639 registers.edx: 12621563 registers.ebx: 8388608 registers.esi: 8847756 registers.ecx: 0	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: file6+0x59e94 @ 0xc09e94 exception.instruction_r: 8b 11 eb 03 89 a9 ee e9 13 0c 00 00 eb 02 3a 93 exception.symbol: file6+0x59abd exception.instruction: mov edx, dword ptr [ecx] exception.module: file6.exe exception.exception_code: 0xc0000005 exception.offset: 367293 exception.address: 0xc09abd registers.esp: 1898376 registers.edi: 8438508 registers.eax: 3468499004 registers.ebp: 1898468 registers.edx: 12623789 registers.ebx: 8847756 registers.esi: 12255232 registers.ecx: 0	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: exception.instruction_r: 8b 00 eb 03 c8 64 f1 e9 58 fa ff ff eb 01 84 0f exception.symbol: file6+0x5a454 exception.instruction: mov eax, dword ptr [eax] exception.module: file6.exe exception.exception_code: 0xc0000005 exception.offset: 369748 exception.address: 0xc0a454 registers.esp: 1898488 registers.edi: 8540292 registers.eax: 0 registers.ebp: 4293655639 registers.edx: 2130566132 registers.ebx: 8388608 registers.esi: 8847756 registers.ecx: 3951558656	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: file6+0x5afec @ 0xc0afec exception.instruction_r: 0f 0b eb 05 8c 95 71 ab 5f 0f 0b eb 01 a3 eb 03 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x888780 registers.esp: 1898152 registers.edi: 8590976 registers.eax: 0 registers.ebp: 1898468 registers.edx: 12613074 registers.ebx: 8847756 registers.esi: 4293712584 registers.ecx: 235	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x77b26ab9 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77b26a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x74b0482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77af0143 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 04 f3 c6 d7 0e eb 04 8c bc 38 01 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x888914 registers.esp: 1896360 registers.edi: 0 registers.eax: 0 registers.ebp: 1896376 registers.edx: 12613074 registers.ebx: 8947871 registers.esi: 0 registers.ecx: 1897028	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x888edc file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897792 registers.edi: 8598220 registers.eax: 0 registers.ebp: 1898152 registers.edx: 0 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x888fd2 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897772 registers.edi: 8949724 registers.eax: 0 registers.ebp: 1898132 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88ad28 0x88abde 0x88a599 0x889c30 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897436 registers.edi: 8601604 registers.eax: 0 registers.ebp: 1897796 registers.edx: 0 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88ad97 0x88abde 0x88a599 0x889c30 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897436 registers.edi: 8601604 registers.eax: 0 registers.ebp: 1897796 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88adbd 0x88a841 0x88a5dc 0x889c30 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897132 registers.edi: 1897666 registers.eax: 0 registers.ebp: 1897492 registers.edx: 1931277120 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88aecf 0x88a841 0x88a5dc 0x889c30 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897132 registers.edi: 1897666 registers.eax: 0 registers.ebp: 1897492 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88adbd 0x88a7a5 0x88a63e 0x889c30 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897128 registers.edi: 1897630 registers.eax: 0 registers.ebp: 1897488 registers.edx: 0 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88aecf 0x88a7a5 0x88a63e 0x889c30 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897128 registers.edi: 1897630 registers.eax: 0 registers.ebp: 1897488 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88b1a8 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897792 registers.edi: 8607176 registers.eax: 0 registers.ebp: 1898152 registers.edx: 0 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88bf73 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897704 registers.edi: 8607176 registers.eax: 0 registers.ebp: 1898064 registers.edx: 8958376 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88c305 0x88b85b file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897296 registers.edi: 8607176 registers.eax: 0 registers.ebp: 1897656 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88cab8 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897696 registers.edi: 8607176 registers.eax: 0 registers.ebp: 1898056 registers.edx: 0 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88cc5a 0x88b8ff file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897676 registers.edi: 1898164 registers.eax: 0 registers.ebp: 1898036 registers.edx: 8921941 registers.ebx: 8964814 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x89106a file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: 0f 0b 0f 0b eb 04 c7 28 4e 35 eb 03 0f 18 06 f7 exception.instruction: ud2 exception.exception_code: 0xc000001d exception.symbol: exception.address: 0x881750 registers.esp: 1897696 registers.edi: 8607176 registers.eax: 0 registers.ebp: 1898056 registers.edx: 2246653957 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x891d5b 0x88b960 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897580 registers.edi: 8607176 registers.eax: 0 registers.ebp: 1897940 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88b9a1 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897708 registers.edi: 8607176 registers.eax: 0 registers.ebp: 1898068 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88d5b7 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897484 registers.edi: 12501185 registers.eax: 0 registers.ebp: 1897844 registers.edx: 0 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88dd8f 0x892bb8 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897204 registers.edi: 12501185 registers.eax: 0 registers.ebp: 1897564 registers.edx: 1464449522 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x883054 0x892bb8 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1897196 registers.edi: 12501185 registers.eax: 0 registers.ebp: 1897556 registers.edx: 3951558656 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x883138 0x88ddea 0x892bb8 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897188 registers.edi: 12501185 registers.eax: 0 registers.ebp: 1897548 registers.edx: 8921941 registers.ebx: 4292324196 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88de0d 0x892bb8 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897204 registers.edi: 12501185 registers.eax: 0 registers.ebp: 1897564 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88d7c9 0x892bb8 file6+0x6e494 @ 0xc1e494 file6+0x5afec @ 0xc0afec exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1897208 registers.edi: 12501185 registers.eax: 0 registers.ebp: 1897568 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: exception.instruction_r: 8b 11 eb 03 15 4c e2 e9 24 fe ff ff eb 03 00 b9 exception.symbol: file6+0x5b1a3 exception.instruction: mov edx, dword ptr [ecx] exception.module: file6.exe exception.exception_code: 0xc0000005 exception.offset: 373155 exception.address: 0xc0b1a3 registers.esp: 1898488 registers.edi: 8540300 registers.eax: 9555554 registers.ebp: 4293659301 registers.edx: 8639192 registers.ebx: 8388608 registers.esi: 8847756 registers.ecx: 0	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: exception.instruction_r: 0f 0b eb 01 1a 0f 0b eb 03 81 60 d2 e9 48 fd ff exception.symbol: file6+0x5b10c exception.instruction: ud2 exception.module: file6.exe exception.exception_code: 0xc000001d exception.offset: 373004 exception.address: 0xc0b10c registers.esp: 1898488 registers.edi: 8540300 registers.eax: 1 registers.ebp: 4293659301 registers.edx: 2130566132 registers.ebx: 8388608 registers.esi: 8847756 registers.ecx: 3951558656	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x87d6ad file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1898000 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1898360 registers.edx: 1951531116 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88d180 0x87d7f7 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1896900 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897260 registers.edx: 8847756 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x89106a 0x87d7f7 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1896888 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897248 registers.edx: 0 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x891d5b 0x88d229 0x87d7f7 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1896772 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897132 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88d26e 0x87d7f7 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1896900 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897260 registers.edx: 8921941 registers.ebx: 8847756 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88f689 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1896912 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897272 registers.edx: 8966528 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88dd8f 0x87d979 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1896888 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897248 registers.edx: 1897272 registers.ebx: 4290182936 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x883054 0x87d979 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1896880 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897240 registers.edx: 0 registers.ebx: 4290182936 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x883138 0x88ddea 0x87d979 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1896872 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897232 registers.edx: 8921941 registers.ebx: 4292324196 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88de0d 0x87d979 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1896888 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897248 registers.edx: 8921941 registers.ebx: 4290182936 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88fc00 0x87d979 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1896892 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897252 registers.edx: 8921941 registers.ebx: 4290182936 registers.esi: 8921941 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88f689 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1896912 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897272 registers.edx: 4244853788 registers.ebx: 8847756 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x88dd8f 0x87d9ff 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1896888 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897248 registers.edx: 1897272 registers.ebx: 4290182936 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x883054 0x87d9ff 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 01 75 eb 1e eb 05 28 8a 8a 3a 21 eb 01 exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x88175f registers.esp: 1896880 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897240 registers.edx: 0 registers.ebx: 4290182936 registers.esi: 8918697 registers.ecx: 8847756	1
__exception__ Sept. 25, 2021, 10:56 a.m.	stacktrace: 0x883138 0x88ddea 0x87d9ff 0x87823f file6+0x1fdfd @ 0xbcfdfd file6+0x14aef @ 0xbc4aef file6+0xba41 @ 0xbbba41 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76a433ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: f7 f0 eb 05 c4 3d 88 bd f6 eb 07 eb 05 c1 ba 5c exception.instruction: div eax exception.exception_code: 0xc0000094 exception.symbol: exception.address: 0x8823f9 registers.esp: 1896872 registers.edi: 8887024 registers.eax: 0 registers.ebp: 1897232 registers.edx: 8921941 registers.ebx: 4292324196 registers.esi: 8921941 registers.ecx: 8847756	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://api.ip.sb/geoip

Performs some HTTP requests (1 event)

request

GET https://api.ip.sb/geoip

Allocates read-write-execute memory (usually to unpack itself) (50 out of 74 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 region_size: 253952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 region_size: 282624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 159744 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 61440 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd8000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x001cf000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 region_size: 159744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f92000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 1644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74043000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72ca2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003dd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003de000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0128f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01280000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01281000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003df000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\clipper)).exe
file	C:\Users\test22\AppData\Local\Temp\1.exe

Creates a suspicious process (3 events)

cmdline	schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Local\Temp\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline	"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline	cmd.exe /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\clipper)).exe
file	C:\Users\test22\AppData\Local\Temp\1.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\1.exe
file	C:\Users\test22\AppData\Local\Temp\clipper)).exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 25, 2021, 10:56 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f filepath: cmd.exe	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x008c0000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 25, 2021, 10:56 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x000176b6', u'virtual_address': u'0x0003c000', u'entropy': 7.990201432643119, u'name': u'.rsrc', u'virtual_size': u'0x00018380'}

entropy

7.99020143264

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00019604', u'virtual_address': u'0x00055000', u'entropy': 7.9974356801728685, u'name': u'', u'virtual_size': u'0x0001a000'}

entropy

7.99743568017

description

A section with a high entropy has been found

entropy

0.997444829273

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 25, 2021, 10:56 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Install itself for autorun at Windows startup	rule	Persistence

Queries for potentially installed applications (50 out of 53 events)

Time & API	Arguments	Status
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000208 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: 7-Zip base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: AddressBook base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: Adobe AIR base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: Connection Manager base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: EditPlus base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: ePageSafer base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: Fontcore base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: Google Chrome base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: IE40 base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: IE4Data base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: IEData base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: Office14.PROPLUS base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: TouchEn nxKey base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: UnINISafeWeb base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: UnINISafeWeb6 base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: WIC base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1 base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1 base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {8941A397-4065-4F41-92CE-0EB610846EED}_is1 base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-006E-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-00A1-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {90140000-00BA-0412-0000-0000000FF1CE} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Sept. 25, 2021, 10:57 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000208 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Local\Temp\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline	"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline	cmd.exe /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: 7fd0e764881bd7e9ddbedb2eef375762cac94b10
buffer	Buffer with sha1: 80c79d8ca2915c3b3a4741ff93f7017de79f4475
buffer	Buffer with sha1: 47a39981179ab497ff3e44465591c0e050e1b0ff

Communicates with host for which no DNS query was performed (1 event)

host

65.21.236.62

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 1644 region_size: 159744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000090	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 25, 2021, 10:56 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Installs itself for autorun at Windows startup (3 events)

cmdline	schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Local\Temp\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline	"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline	cmd.exe /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 25, 2021, 10:56 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1644 process_handle: 0x00000090	1	1	0

Collects information about installed applications (40 events)

Time & API	Arguments	Status
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 6.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Delfino G3 (x86) version 3.6.6.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: G2BRUN regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: WIZVERA Process Manager 1,0,5,4 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Sept. 25, 2021, 10:57 a.m.	key_handle: 0x00000204 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2472 called NtSetContextThread to modify thread in remote process 1644
NtSetContextThread Sept. 25, 2021, 10:56 a.m.	registers.eip: 2007957956 registers.esp: 3734676 registers.edi: 0 registers.eax: 4201185 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000b4 process_identifier: 1644	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2472 resumed a thread in remote process 1644
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000000b4 suspend_count: 1 process_identifier: 1644	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (3 events)

cmdline	schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Local\Temp\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline	"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline	cmd.exe /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f

Executed a process and injected code into it, probably while unpacking (26 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 25, 2021, 10:56 a.m.	thread_identifier: 2916 thread_handle: 0x000000b4 process_identifier: 1644 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000090	1	1
NtGetContextThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000000b4	1	0
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 1644 region_size: 159744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000090	1	0
WriteProcessMemory Sept. 25, 2021, 10:56 a.m.	buffer: base_address: 0x00400000 process_identifier: 1644 process_handle: 0x00000090	1	1
WriteProcessMemory Sept. 25, 2021, 10:56 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1644 process_handle: 0x00000090	1	1
NtSetContextThread Sept. 25, 2021, 10:56 a.m.	registers.eip: 2007957956 registers.esp: 3734676 registers.edi: 0 registers.eax: 4201185 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000b4 process_identifier: 1644	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000000b4 suspend_count: 1 process_identifier: 1644	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x00000138 suspend_count: 1 process_identifier: 1644	1	0
CreateProcessInternalW Sept. 25, 2021, 10:56 a.m.	thread_identifier: 1168 thread_handle: 0x00000300 process_identifier: 808 current_directory: C:\Users\test22\AppData\Local\Temp\ filepath: C:\Users\test22\AppData\Local\Temp\clipper)).exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\clipper)).exe" filepath_r: C:\Users\test22\AppData\Local\Temp\clipper)).exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000308	1	1
CreateProcessInternalW Sept. 25, 2021, 10:56 a.m.	thread_identifier: 2320 thread_handle: 0x00000300 process_identifier: 2324 current_directory: C:\Users\test22\AppData\Local\Temp\ filepath: C:\Users\test22\AppData\Local\Temp\1.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
CreateProcessInternalW Sept. 25, 2021, 10:56 a.m.	thread_identifier: 2212 thread_handle: 0x00000290 process_identifier: 1904 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %TEMP%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000298	1	1
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000002b4 suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000003fc suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x0000069c suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x0000070c suspend_count: 1 process_identifier: 2324	1	0
NtGetContextThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000000ec	1	0
NtGetContextThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000000ec	1	0
NtResumeThread Sept. 25, 2021, 10:56 a.m.	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:57 a.m.	thread_handle: 0x00000640 suspend_count: 1 process_identifier: 2324	1	0
NtResumeThread Sept. 25, 2021, 10:57 a.m.	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 2324	1	0
CreateProcessInternalW Sept. 25, 2021, 10:56 a.m.	thread_identifier: 2700 thread_handle: 0x00000084 process_identifier: 1632 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Local\Temp\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f filepath_r: C:\Windows\system32\schtasks.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000088	1	1

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetect.malware1
MicroWorld-eScan	Gen:Variant.Doina.24631
FireEye	Generic.mg.6200236a6524e95a
McAfee	Artemis!6200236A6524
Cylance	Unsafe
Cybereason	malicious.d9eb29
Arcabit	Trojan.Doina.D6037
BitDefenderTheta	Gen:NN.ZexaF.34170.Bq3@aWGfFreQ
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.Obsidium.CF
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.Win32.Reline.gen
BitDefender	Gen:Variant.Doina.24631
Ad-Aware	Gen:Variant.Doina.24631
Emsisoft	Gen:Variant.Doina.24631 (B)
McAfee-GW-Edition	BehavesLike.Win32.Trojan.gc
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Kingsoft	Win32.Heur.KVMH015.a.(kcloud)
Microsoft	VirTool:Win32/Vbinder
ZoneAlarm	HEUR:Trojan-PSW.Win32.Reline.gen
GData	Gen:Variant.Doina.24631
Cynet	Malicious (score: 100)
Acronis	suspicious
ALYac	Gen:Variant.Doina.24631
MAX	malware (ai score=81)
VBA32	BScope.Exploit.ShellCode
Malwarebytes	Malware.Heuristic.1003
Panda	Trj/CI.A
Zoner	Probably Heur.ExeHeaderH
Rising	Trojan.Generic@ML.94 (RDML:VvI7vTDFvDjks8AoS3sPlw)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Reline!tr.pws
AVG	FileRepMalware
Avast	FileRepMalware
CrowdStrike	win/malicious_confidence_80% (W)

file6.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All