Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 5, 2021, 9:11 a.m.	Nov. 5, 2021, 9:27 a.m.

Size	4.1MB
Type	MS-DOS executable, MZ for MS-DOS
MD5	`a26c091f560286c77dc695818846a27e`
SHA256	`18bf017bdd74e8e8f5db5a4dd7ec3409021c7b0d2f125f05d728f3b740132015`
CRC32	`4020A23B`
ssdeep	`98304:tVHcyjffTYM6jPFhCfKrGzAs29VXD56hsI+LmjPlo4SBd+1uz9QYR2:tVHZrfY1LVXMsjmjPaTPi+2`
Yara	MPRESS_Zero - MPRESS packed file PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

9801_1635938030_9423.exe "C:\Users\test22\AppData\Local\Temp\9801_1635938030_9423.exe"
2768
- OQxtPfFqST.exe "C:\Users\test22\AppData\Local\Temp\OQxtPfFqST.exe"
  3016
- jL6HjH9rpl.exe "C:\Users\test22\AppData\Local\Temp\jL6HjH9rpl.exe"
  3056

Name	Response	Post-Analysis Lookup
teleliver.top	A 104.21.62.135 A 172.67.136.46	172.67.136.46
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.130.233

IP Address	Status	Action
104.21.62.135	Active	Moloch
162.159.129.233	Active	Moloch
164.124.101.2	Active	Moloch
91.219.236.97	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:55871 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.101:49161 -> 104.21.62.135:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.101:49163 -> 91.219.236.97:80	2033973	ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)	Malware Command and Control Activity Detected
TCP 91.219.236.97:80 -> 192.168.56.101:49163	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 91.219.236.97:80 -> 192.168.56.101:49163	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 91.219.236.97:80 -> 192.168.56.101:49163	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49228 -> 162.159.129.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49163 -> 91.219.236.97:80	2033973	ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49163 -> 91.219.236.97:80	2033974	ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49228 162.159.129.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameA Nov. 5, 2021, 9:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 5, 2021, 9:04 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 5, 2021, 9:04 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 5, 2021, 9:04 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:04 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:04 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:04 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:04 a.m.			0	0
IsDebuggerPresent Nov. 5, 2021, 9:04 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 5, 2021, 9:11 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.MPRESS1
section	.MPRESS2

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	REGISTRY
resource name	TYPELIB

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Nov. 5, 2021, 9:11 a.m.	stacktrace: 9801_1635938030_9423+0x530430 @ 0xf90430 9801_1635938030_9423+0x53e1fe @ 0xf9e1fe exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x760cb727 registers.esp: 4652324 registers.edi: 12566528 registers.eax: 4652324 registers.ebp: 4652404 registers.edx: 2130566132 registers.ebx: 1992228838 registers.esi: 2003530795 registers.ecx: 1911160832	1
__exception__ Nov. 5, 2021, 9:11 a.m.	stacktrace: exception.instruction_r: ed e9 08 2f 04 00 ac 4c ea bf 6b 42 11 44 72 00 exception.symbol: 9801_1635938030_9423+0x553916 exception.instruction: in eax, dx exception.module: 9801_1635938030_9423.exe exception.exception_code: 0xc0000096 exception.offset: 5585174 exception.address: 0xfb3916 registers.esp: 4652444 registers.edi: 7679342 registers.eax: 1750617430 registers.ebp: 12566528 registers.edx: 22614 registers.ebx: 10878976 registers.esi: 13 registers.ecx: 20	1
__exception__ Nov. 5, 2021, 9:11 a.m.	stacktrace: exception.instruction_r: ed e9 22 96 09 00 c3 e9 ff b8 09 00 0a 08 a0 24 exception.symbol: 9801_1635938030_9423+0x4c92ae exception.instruction: in eax, dx exception.module: 9801_1635938030_9423.exe exception.exception_code: 0xc0000096 exception.offset: 5018286 exception.address: 0xf292ae registers.esp: 4652444 registers.edi: 7679342 registers.eax: 1447909480 registers.ebp: 12566528 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (6 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://teleliver.top/mixmorty14
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://91.219.236.97/
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://91.219.236.97//l/f/IKB87XwB3dP17Spzni02/3f01e0ee7d7616e1a5b10f5e09c686af287a09ab
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://91.219.236.97//l/f/IKB87XwB3dP17Spzni02/70fba09628631dc7968147158bcd96dd2a63758b
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/896848939771367444/900335715949363280/Antesternal.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/899705176418578565/905408828730900501/malik_2.0.exe

Performs some HTTP requests (6 events)

request	GET http://teleliver.top/mixmorty14
request	POST http://91.219.236.97/
request	GET http://91.219.236.97//l/f/IKB87XwB3dP17Spzni02/3f01e0ee7d7616e1a5b10f5e09c686af287a09ab
request	GET http://91.219.236.97//l/f/IKB87XwB3dP17Spzni02/70fba09628631dc7968147158bcd96dd2a63758b
request	GET https://cdn.discordapp.com/attachments/896848939771367444/900335715949363280/Antesternal.exe
request	GET https://cdn.discordapp.com/attachments/899705176418578565/905408828730900501/malik_2.0.exe

Sends data using the HTTP POST Method (1 event)

request

POST http://91.219.236.97/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 197 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x776df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77650000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 434176 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 106496 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aeb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 434176 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 106496 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00acb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:11 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae5000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef477b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002900000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40e4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9495a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9496c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 5, 2021, 9:04 a.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 3821568 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c22000 process_handle: 0xffffffffffffffff	1

Foreign language identified in PE resource (2 events)

name

RT_MENU

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0070b228

size

0x00000022

name

RT_MENU

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0070b228

size

0x00000022

Creates executable files on the filesystem (50 out of 61 events)

file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\ucrtbase.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-sysinfo-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-namedpipe-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-multibyte-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\MapiProxy_InUse.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-math-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-synch-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-heap-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-libraryloader-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-filesystem-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-file-l2-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\OQxtPfFqST.exe
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-private-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\ldif60.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\lgpllibs.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\libEGL.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-timezone-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\mozMapi32.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\mozMapi32_InUse.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\AccessibleHandler.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-rtlsupport-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\vcruntime140.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-interlocked-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-processenvironment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\freebl3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-heap-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-time-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-environment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\qipcap.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-profile-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\AccessibleMarshal.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-localization-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\sqlite3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-handle-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\nss3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-string-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\nssckbi.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-convert-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-util-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\ldap60.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-file-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-stdio-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-processthreads-l1-1-1.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\nssdbm3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\softokn3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\breakpadinjector.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-synch-l1-2-0.dll

Drops an executable to the user AppData folder (50 out of 58 events)

file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-synch-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-file-l2-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-locale-l1-1-0.dll
file	C:\Users\test22\AppData\Local\Temp\jL6HjH9rpl.exe
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\breakpadinjector.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\prldap60.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-private-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\nss3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-namedpipe-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\mozglue.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-libraryloader-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\softokn3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\vcruntime140.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-environment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\MapiProxy.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\IA2Marshal.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-heap-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-time-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-math-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-string-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-memory-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-sysinfo-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-util-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-localization-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-processthreads-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-filesystem-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\msvcp140.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-stdio-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\AccessibleHandler.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\qipcap.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-utility-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-processthreads-l1-1-1.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-heap-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\sqlite3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\freebl3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\ucrtbase.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\libEGL.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-processenvironment-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-handle-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\nssckbi.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-timezone-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\nssdbm3.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\lgpllibs.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-synch-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-conio-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-file-l1-2-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\ldap60.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-interlocked-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-core-profile-l1-1-0.dll
file	C:\Users\test22\AppData\LocalLow\iT6tF6rB9\api-ms-win-crt-multibyte-l1-1-0.dll

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 5, 2021, 9:11 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\OQxtPfFqST.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\OQxtPfFqST.exe	1	1	0
ShellExecuteExW Nov. 5, 2021, 9:11 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\jL6HjH9rpl.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\jL6HjH9rpl.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00412c00', u'virtual_address': u'0x00001000', u'entropy': 7.99995530522368, u'name': u'.MPRESS1', u'virtual_size': u'0x00724000'}

entropy

7.99995530522

description

A section with a high entropy has been found

entropy

0.9943974252

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

Queries for potentially installed applications (40 events)

Time & API	Arguments	Status	Return
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000002e4 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1	0
RegOpenKeyExW Nov. 5, 2021, 9:11 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall		2

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 9cdaff48519006888ecbad99542adcdae49b96f7

Communicates with host for which no DNS query was performed (1 event)

host

91.219.236.97

Checks for the presence of known windows from debuggers and forensic tools (30 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Nov. 5, 2021, 9:11 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Attempts to access Bitcoin/ALTCoin wallets (1 event)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\OQxtPfFqST.exe
file	C:\Users\test22\AppData\Local\Temp\jL6HjH9rpl.exe

A potential heapspray has been detected. 91 megabytes was sprayed onto the heap of the OQxtPfFqST.exe process (1 event)

count

1457

name

heapspray

process

OQxtPfFqST.exe

total_mb

length

65536

protection

PAGE_READWRITE

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExA Nov. 5, 2021, 9:11 a.m.	key_handle: 0x000002f0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Harvests credentials from local email clients (4 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Nov. 5, 2021, 9:11 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 5, 2021, 9:11 a.m.	stacktrace: exception.instruction_r: ed e9 22 96 09 00 c3 e9 ff b8 09 00 0a 08 a0 24 exception.symbol: 9801_1635938030_9423+0x4c92ae exception.instruction: in eax, dx exception.module: 9801_1635938030_9423.exe exception.exception_code: 0xc0000096 exception.offset: 5018286 exception.address: 0xf292ae registers.esp: 4652444 registers.edi: 7679342 registers.eax: 1447909480 registers.ebp: 12566528 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Racealer.i!c
MicroWorld-eScan	Gen:Variant.Jaik.48604
FireEye	Gen:Variant.Jaik.48604
ALYac	Gen:Variant.Jaik.48604
Cylance	Unsafe
Sangfor	Infostealer.Win32.Racealer.mlx
CrowdStrike	win/malicious_confidence_60% (W)
K7GW	Trojan ( 00589dca1 )
K7AntiVirus	Trojan ( 00589dca1 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenCBL.BAU
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-PSW.Win32.Racealer.mlx
BitDefender	Gen:Variant.Jaik.48604
Avast	Win32:Trojan-gen
Ad-Aware	Gen:Variant.Jaik.48604
Emsisoft	Gen:Variant.Jaik.48604 (B)
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-R + Mal/EncPk-PC
MAX	malware (ai score=89)
Kingsoft	Win32.PSWTroj.Racealer.m.(kcloud)
Gridinsoft	Ransom.Win32.AzorUlt.sa
Microsoft	Trojan:Script/Phonzy.C!ml
GData	Gen:Variant.Jaik.48604
McAfee	Artemis!A26C091F5602
Ikarus	Trojan.Win32.Generic
Fortinet	W32/GenCBL.BAU!tr
AVG	Win32:Trojan-gen
Panda	Trj/CI.A

9801_1635938030_9423.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All