Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 29, 2023, 5:32 p.m.	March 29, 2023, 5:34 p.m.

Size	7.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3aaff573f4866483b434e7a4d24f83eb`
SHA256	`42ab5eb20d65d2e52568c773e1a93cc2ccaeb27cc7e0653a433574d119c898e7`
CRC32	`A112D010`
ssdeep	`196608:VYJ219pO6MBX19JJe2ng0wBMaPdzky/OjHZ5AOdml1JxxYUO4L+WjpjT:VeKpO6a95gdBBaZvdml1JxxYPmlv`
PDB Path	D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

101.exe "C:\Users\test22\AppData\Local\Temp\101.exe"
1132
- 123.exe "C:\Windows\Temp\123.exe"
  2208
- 321.exe "C:\Windows\Temp\321.exe"
  2256
  - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --remote-debugging-port=58851 --headless --user-data-dir="C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO" --profile-directory="Default"
    2364
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb8,0xbc,0xc0,0x8c,0xc4,0x7fef3e36e00,0x7fef3e36e10,0x7fef3e36e20
      2460
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod= --annotation=ver= --initial-client-data=0x180,0x184,0x188,0x17c,0x18c,0x7fef3743d58,0x7fef3743d68,0x7fef3743d78
      2536

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
51.210.161.21	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW March 29, 2023, 5:32 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (34 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 29, 2023, 5:32 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:32 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:32 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:32 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:26 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0
IsDebuggerPresent March 29, 2023, 5:25 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (20 events)

Time & API	Arguments	Status	Return
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a8950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a8950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a8950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a8950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a89d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a89d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a88d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a8950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a8950 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a8b50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a9290 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a9290 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x007a9150 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071b050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071b050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 29, 2023, 5:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0071aed0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 29, 2023, 5:32 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

PNG

One or more processes crashed (8 events)

Time & API	Arguments	Status
__exception__ March 29, 2023, 5:32 p.m.	stacktrace: 123+0x5dd013 @ 0x12bd013 123+0x5d9161 @ 0x12b9161 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 f5 4f 93 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 3668468 registers.edi: 13729792 registers.eax: 3668468 registers.ebp: 3668548 registers.edx: 2130566132 registers.ebx: 15671977 registers.esi: 2006021163 registers.ecx: 1371209728	1
__exception__ March 29, 2023, 5:32 p.m.	stacktrace: exception.instruction_r: ed e9 df 79 00 00 c3 e9 a9 5b f6 ff ce 1c d6 ff exception.symbol: 123+0x5cd6c1 exception.instruction: in eax, dx exception.module: 123.exe exception.exception_code: 0xc0000096 exception.offset: 6084289 exception.address: 0x12ad6c1 registers.esp: 3668588 registers.edi: 16889453 registers.eax: 1750617430 registers.ebp: 13729792 registers.edx: 7755862 registers.ebx: 15671977 registers.esi: 2605036 registers.ecx: 20	1
__exception__ March 29, 2023, 5:32 p.m.	stacktrace: exception.instruction_r: ed e9 6f fe 00 00 06 17 0a 00 00 00 0b 34 fb 21 exception.symbol: 123+0x5c2b69 exception.instruction: in eax, dx exception.module: 123.exe exception.exception_code: 0xc0000096 exception.offset: 6040425 exception.address: 0x12a2b69 registers.esp: 3668588 registers.edi: 16889453 registers.eax: 1447909480 registers.ebp: 13729792 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 2605036 registers.ecx: 10	1
__exception__ March 29, 2023, 5:32 p.m.	stacktrace: 0x2b13d6c 0x2b13c8e 0x2b124dd 0x2b120b6 0x2b105a0 0x2b1006c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73ea2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73eb264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73eb2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73f674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73f67610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73ff1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73ff1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73ff1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73ff416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7486f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73d57f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73d54de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2b13e60 registers.esp: 3665080 registers.edi: 3665132 registers.eax: 0 registers.ebp: 3665144 registers.edx: 7954528 registers.ebx: 3666028 registers.esi: 51709016 registers.ecx: 0	1
__exception__ March 29, 2023, 5:32 p.m.	stacktrace: 321+0x4efbb9 @ 0xe3fbb9 321+0x52db8c @ 0xe7db8c exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 5568324 registers.edi: 10362880 registers.eax: 5568324 registers.ebp: 5568404 registers.edx: 4294826996 registers.ebx: 0 registers.esi: 2006021163 registers.ecx: 1343750144	1
__exception__ March 29, 2023, 5:32 p.m.	stacktrace: exception.instruction_r: ed e9 46 7b 06 00 0c 00 9c 1a fe ff 76 70 73 91 exception.symbol: 321+0x4d1359 exception.instruction: in eax, dx exception.module: 321.exe exception.exception_code: 0xc0000096 exception.offset: 5051225 exception.address: 0xe21359 registers.esp: 5568444 registers.edi: 7090298 registers.eax: 1750617430 registers.ebp: 10362880 registers.edx: 22614 registers.ebx: 9764864 registers.esi: 2473964 registers.ecx: 20	1
__exception__ March 29, 2023, 5:32 p.m.	stacktrace: exception.instruction_r: ed e9 b0 02 00 00 c3 e9 99 9f ff ff 7d b7 52 0c exception.symbol: 321+0x5372e1 exception.instruction: in eax, dx exception.module: 321.exe exception.exception_code: 0xc0000096 exception.offset: 5468897 exception.address: 0xe872e1 registers.esp: 5568444 registers.edi: 7090298 registers.eax: 1447909480 registers.ebp: 10362880 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 2473964 registers.ecx: 10	1
__exception__ March 29, 2023, 5:26 p.m.	stacktrace: 0x180004 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 fc 76 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x180004 registers.r14: 240709576 registers.r15: 263562288 registers.rcx: 1404 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 240708832 registers.rsp: 240708552 registers.r11: 240712448 registers.r8: 2004779404 registers.r9: 0 registers.rdx: 1288 registers.r12: 240709192 registers.rbp: 240708688 registers.rdi: 263619040 registers.rax: 1572864 registers.r13: 127499968	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Starts servers listening (13 events)

Time & API	Arguments	Status	Return
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1280 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1280 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1344 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1348 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1344 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1348 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1344 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1348 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1344 port: 0	1	0
bind March 29, 2023, 5:32 p.m.	ip_address: 0.0.0.0 socket: 1348 port: 0	1	0
bind March 29, 2023, 5:25 p.m.	ip_address: 127.0.0.1 socket: 944 port: 58851	1	0
listen March 29, 2023, 5:25 p.m.	socket: 944 backlog: 10	1	0
accept March 29, 2023, 5:25 p.m.	ip_address: socket: 944 port: 0		-1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 238 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7580c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7580a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7586f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7581c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7581d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75608000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7580c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75443000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7580c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7559c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 5:32 p.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757f4000 process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 2364 crashed
__exception__ March 29, 2023, 5:26 p.m.	stacktrace: 0x180004 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 fc 76 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x180004 registers.r14: 240709576 registers.r15: 263562288 registers.rcx: 1404 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 240708832 registers.rsp: 240708552 registers.r11: 240712448 registers.r8: 2004779404 registers.r9: 0 registers.rdx: 1288 registers.r12: 240709192 registers.rbp: 240708688 registers.rdi: 263619040 registers.rax: 1572864 registers.r13: 127499968	1	0	0

Steals private information from local Internet browsers (50 out of 109 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Safe Browsing Channel IDs
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Last Version
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\TransportSecurity
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Application Cache\Index
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Media History
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Translate Ranker Model
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Local Storage\leveldb\000003.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\File System\primary.origin
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Secure Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Code Cache\wasm
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\MANIFEST-000004
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Origin Bound Certs-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\GPUCache\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Trust Tokens
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Local Storage\leveldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Safe Browsing Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Local Storage\leveldb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Local Storage\leveldb\LOG
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Favicons-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Reporting and NEL
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\DevToolsActivePort
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\previews_opt_out.db
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\chrome_shutdown_ms.txt
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Network Action Predictor-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Trust Tokens-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\History
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Web Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Service Worker\Database\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Safe Browsing Cookies-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Cookies-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\LOG
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\000006.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\LOG.old
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Default\Local Storage
file	C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Safe Browsing Channel IDs-journal

Creates executable files on the filesystem (2 events)

file	C:\Windows\Temp\123.exe
file	C:\Windows\Temp\321.exe

Drops a binary and executes it (2 events)

file	C:\Windows\Temp\123.exe
file	C:\Windows\Temp\321.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 29, 2023, 5:32 p.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000e200', u'virtual_address': u'0x0005d000', u'entropy': 6.802287495720708, u'name': u'.rsrc', u'virtual_size': u'0x0000e034'}

entropy

6.80228749572

description

A section with a high entropy has been found

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 29, 2023, 5:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 29, 2023, 5:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (50 out of 51 events)

Time & API	Arguments	Status
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: 7-Zip base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: AddressBook base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: Adobe AIR base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: Connection Manager base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: DirectDrawEx base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: EditPlus base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: Fontcore base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: Google Chrome base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: IE40 base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: IE4Data base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: IE5BAKEX base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: IEData base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: MobileOptionPack base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: Office15.PROPLUSR base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: SchedulingAgent base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: WIC base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW March 29, 2023, 5:32 p.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x00000330 key_handle: 0x00000334 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Terminates another process (3 events)

Time & API	Arguments	Status
NtTerminateProcess March 29, 2023, 5:32 p.m.	status_code: 0xffffffff process_identifier: 2256 process_handle: 0x00000548
NtTerminateProcess March 29, 2023, 5:26 p.m.	status_code: 0xc0000005 process_identifier: 2364 process_handle: 0x000000000000018c
NtTerminateProcess March 29, 2023, 5:26 p.m.	status_code: 0xc0000005 process_identifier: 2364 process_handle: 0x000000000000018c	1

Communicates with host for which no DNS query was performed (1 event)

host

51.210.161.21

Checks for the presence of known windows from debuggers and forensic tools (50 out of 81 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA March 29, 2023, 5:32 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA March 29, 2023, 5:32 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation March 29, 2023, 5:32 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

321.exe tried to sleep 2728198 seconds, actually delayed analysis time by 2728198 seconds

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Collects information about installed applications (38 events)

Time & API	Arguments	Status
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW March 29, 2023, 5:32 p.m.	key_handle: 0x00000334 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

One or more non-whitelisted processes were created (3 events)

parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User DataR14BO" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb8,0xbc,0xc0,0x8c,0xc4,0x7fef3e36e00,0x7fef3e36e10,0x7fef3e36e20
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=956,4970203735099767685,2863627013063124770,131072 --headless --headless --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1064 /prefetch:2
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\test22\AppData\Local\Temp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod= --annotation=ver= --initial-client-data=0x180,0x184,0x188,0x17c,0x18c,0x7fef3743d58,0x7fef3743d68,0x7fef3743d78

Resumed a suspended thread in a remote process potentially indicative of process injection (26 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2536 resumed a thread in remote process 2364
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0
NtResumeThread March 29, 2023, 5:26 p.m.	thread_handle: 0x00000000000000fc suspend_count: 2 process_identifier: 2364	1	0	0

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation March 29, 2023, 5:32 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 29, 2023, 5:32 p.m.	stacktrace: exception.instruction_r: ed e9 6f fe 00 00 06 17 0a 00 00 00 0b 34 fb 21 exception.symbol: 123+0x5c2b69 exception.instruction: in eax, dx exception.module: 123.exe exception.exception_code: 0xc0000096 exception.offset: 6040425 exception.address: 0x12a2b69 registers.esp: 3668588 registers.edi: 16889453 registers.eax: 1447909480 registers.ebp: 13729792 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 2605036 registers.ecx: 10	1	0	0

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Lionic	Trojan.Win32.HTA.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.66141089
FireEye	Generic.mg.3aaff573f4866483
CAT-QuickHeal	Trojan.Miner.KG5
McAfee	Artemis!3AAFF573F486
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vcy3
Alibaba	Trojan:Win32/RedLineSteal.b3d22358
Cyren	W32/Trojan.IHJ.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	multiple detections
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.HTA.qe
BitDefender	Trojan.GenericKD.66141089
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:Evo-gen [Trj]
Sophos	Generic ML PUA (PUA)
F-Secure	Trojan.TR/AD.RedLineSteal.tiwhj
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
Emsisoft	Trojan.GenericKD.66141089 (B)
SentinelOne	Static AI - Malicious SFX
Avira	HEUR/AGEN.1332077
Microsoft	Trojan:Script/Phonzy.C!ml
ViRobot	Trojan.Win.Z.Agent.7920430
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.GenericKD.66141089
Google	Detected
AhnLab-V3	Trojan/Win.RedLine.R547528
BitDefenderTheta	Gen:NN.ZexaF.36344.JF0@aSaDgGdi
MAX	malware (ai score=84)
Zoner	Probably Heur.ExeHeaderL
TrendMicro-HouseCall	TROJ_GEN.R002H0CCT23
Rising	Trojan.Generic@AI.92 (RDML:f4ohnLNQjxGOnFCCMUGiHw)
Fortinet	PossibleThreat.PALLAS.H
AVG	Win32:Evo-gen [Trj]

101.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All