Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 19, 2023, 5:57 p.m.	May 19, 2023, 6:01 p.m.

Size	457.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a1feeca49654dafe62b72623b20cd8bd`
SHA256	`f261b983871017c3b616dd7d762602f5d8313c92981706fe587a02efbea23cc5`
CRC32	`F9A8363A`
ssdeep	`12288:24LOMyTvlmerfing0sdcQwX3FpTry1af0:2rtTvDrfiU6f3Fp/`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer

136.exe "C:\Users\test22\AppData\Local\Temp\136.exe"
2556

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
195.123.227.138	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 195.123.227.138:80 -> 192.168.56.101:49163	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 96 events)

Time & API	Arguments	Status	Return
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 19, 2023, 5:57 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (45 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:57 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0
IsDebuggerPresent May 19, 2023, 5:58 p.m.			0	0

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.00cfg
section	.voltbl

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://195.123.227.138/c2sock

Performs some HTTP requests (1 event)

request

POST http://195.123.227.138/c2sock

Sends data using the HTTP POST Method (1 event)

request

POST http://195.123.227.138/c2sock

Steals private information from local Internet browsers (50 out of 64 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000004.log
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000204 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW May 19, 2023, 5:58 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x80000002 key_handle: 0x00000200 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Communicates with host for which no DNS query was performed (1 event)

host

195.123.227.138

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Bitcoin\wallets
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW May 19, 2023, 5:58 p.m.	key_handle: 0x00000200 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 19, 2023, 5:58 p.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Trojan.GenericKD.67093679
McAfee	Artemis!A1FEECA49654
Malwarebytes	Malware.AI.2546871894
Sangfor	Spyware.Win32.Stealerc.V6ku
Alibaba	TrojanPSW:Win32/Stealerc.49764bcb
Arcabit	Trojan.Generic.D3FFC4AF
Cyren	W32/ABRisk.NRAM-6738
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.Agent.PRG
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.Win32.Stealerc.gen
BitDefender	Trojan.GenericKD.67093679
Avast	Win32:SpywareX-gen [Trj]
Tencent	Win32.Trojan-QQPass.QQRob.Kcnw
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Spy.Agent.waigy
VIPRE	Trojan.GenericKD.67093679
TrendMicro	TrojanSpy.Win32.LUMMASTEALER.YXDEQZ
McAfee-GW-Edition	BehavesLike.Win32.Generic.gh
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.a1feeca49654dafe
Emsisoft	Trojan.GenericKD.67093679 (B)
Avira	TR/Spy.Agent.waigy
Antiy-AVL	Trojan[Spy]/Win32.Agent
Gridinsoft	Spy.Win32.Keylogger.cl
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan-PSW.Win32.Stealerc.gen
GData	Trojan.GenericKD.67093679
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5402076
BitDefenderTheta	Gen:NN.ZexaF.36196.CyW@aC2ovd
MAX	malware (ai score=84)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.LUMMASTEALER.YXDEQZ
Rising	Trojan.Generic@AI.97 (RDML:G7nKusGuzpM0pwemSQfkGQ)
Fortinet	PossibleThreat.PALLAS.H
AVG	Win32:SpywareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

136.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All