Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 31, 2023, 9:12 a.m.	May 31, 2023, 9:31 a.m.

Size	1.9MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`fc370061296aefef63818d1a9069f21e`
SHA256	`171c875a544e96c823170d1df870587300965ee069bc7dc35845b1bfccf17465`
CRC32	`E6CE5A75`
ssdeep	`49152:3ewjTwlUzZ5YJOBaVixx56Fu8Q2+Xbb5rZi1ylQ:UKZ4OkVixx56c8Q1X1Zi+Q`
Yara	UPX_Zero - UPX packed file IsPE64 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature

tcpupdate.exe "C:\Users\test22\AppData\Local\Temp\tcpupdate.exe"
1792
- AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2856

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
162.55.188.246	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 162.55.188.246:15647 -> 192.168.56.103:49165	2029217	ET MALWARE Arechclient2 Backdoor CnC Init	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (23 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 31, 2023, 9:13 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (50 out of 83 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 31, 2023, 9:05 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (18 events)

Time & API	Arguments	Status	Return
CryptExportKey May 31, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba40660 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba407b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:06 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001ba407b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b2d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b35c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b35c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b3540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b35c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b35c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b3540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b35c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b3600 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b3600 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b3780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b3780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 31, 2023, 9:13 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005b37c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 31, 2023, 9:05 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 31, 2023, 9:13 a.m.	stacktrace: 0x55bba5c 0x55b79a6 0x55b6b38 0x55b685c 0x55b46a0 0x55b3e9c 0x55b24b9 0x495848f 0x4957b01 0x4957886 system+0x205d05 @ 0x71e45d05 system+0x205cdf @ 0x71e45cdf mscorlib+0x302367 @ 0x728c2367 mscorlib+0x3022a6 @ 0x728c22a6 mscorlib+0x302261 @ 0x728c2261 system+0x205c60 @ 0x71e45c60 system+0x205467 @ 0x71e45467 mscorlib+0x34bb1e @ 0x7290bb1e DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d62652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73d7264f DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73d79dd2 DllGetClassObjectInternal+0x74073 CorDllMainForThunk-0x18488 clr+0x1390ec @ 0x73e990ec LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x73dd7d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x73dd7dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x73dd7e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x73d6c3bf DllGetClassObjectInternal+0x7412f CorDllMainForThunk-0x183cc clr+0x1391a8 @ 0x73e991a8 DllGetClassObjectInternal+0x74178 CorDllMainForThunk-0x18383 clr+0x1391f1 @ 0x73e991f1 GetMetaDataInternalInterfaceFromPublic+0xab22 PreBindAssemblyEx-0x982 clr+0x1771e9 @ 0x73ed71e9 DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x73e7a0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x55bca96 registers.esp: 94496764 registers.edi: 39526700 registers.eax: 0 registers.ebp: 94496796 registers.edx: 6486928 registers.ebx: 1 registers.esi: 39526916 registers.ecx: 0	1	0	0
__exception__ May 31, 2023, 9:13 a.m.	stacktrace: 0x55bba5c 0x55b79a6 0x55b6b38 0x55b685c 0x60d45d3 0x60d3cd1 mscorlib+0x30c9ff @ 0x728cc9ff mscorlib+0x302367 @ 0x728c2367 mscorlib+0x3022a6 @ 0x728c22a6 mscorlib+0x302261 @ 0x728c2261 mscorlib+0x30ca7c @ 0x728cca7c DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d62652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73d7264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73d72e95 DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x73e007d8 LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x73dd7d4d LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x73dd7dbb LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x73dd7e88 DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x73d6c3bf DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x73e00694 DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x73e7a0cf BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x55bca96 registers.esp: 105965924 registers.edi: 39249564 registers.eax: 0 registers.ebp: 105965956 registers.edx: 98102304 registers.ebx: 1 registers.esi: 39249780 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 31, 2023, 9:13 a.m.

stacktrace:

0x55bba5c
0x55b79a6
0x55b6b38
0x55b685c
0x55b46a0
0x55b3e9c
0x55b24b9
0x495848f
0x4957b01
0x4957886
system+0x205d05 @ 0x71e45d05
system+0x205cdf @ 0x71e45cdf
mscorlib+0x302367 @ 0x728c2367
mscorlib+0x3022a6 @ 0x728c22a6
mscorlib+0x302261 @ 0x728c2261
system+0x205c60 @ 0x71e45c60
system+0x205467 @ 0x71e45467
mscorlib+0x34bb1e @ 0x7290bb1e
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73d7264f
DllRegisterServerInternal+0x79c6 CoUninitializeEE-0x5a72 clr+0x19dd2 @ 0x73d79dd2
DllGetClassObjectInternal+0x74073 CorDllMainForThunk-0x18488 clr+0x1390ec @ 0x73e990ec
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x73dd7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x73dd7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x73dd7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x73d6c3bf
DllGetClassObjectInternal+0x7412f CorDllMainForThunk-0x183cc clr+0x1391a8 @ 0x73e991a8
DllGetClassObjectInternal+0x74178 CorDllMainForThunk-0x18383 clr+0x1391f1 @ 0x73e991f1
GetMetaDataInternalInterfaceFromPublic+0xab22 PreBindAssemblyEx-0x982 clr+0x1771e9 @ 0x73ed71e9
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x73e7a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x55bca96
registers.esp: 94496764
registers.edi: 39526700
registers.eax: 0
registers.ebp: 94496796
registers.edx: 6486928
registers.ebx: 1
registers.esi: 39526916
registers.ecx: 0

__exception__

May 31, 2023, 9:13 a.m.

stacktrace:

0x55bba5c
0x55b79a6
0x55b6b38
0x55b685c
0x60d45d3
0x60d3cd1
mscorlib+0x30c9ff @ 0x728cc9ff
mscorlib+0x302367 @ 0x728c2367
mscorlib+0x3022a6 @ 0x728c22a6
mscorlib+0x302261 @ 0x728c2261
mscorlib+0x30ca7c @ 0x728cca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73d62652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73d7264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73d72e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x73e007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x73dd7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x73dd7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x73dd7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x73d6c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x73e00694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x73e7a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x55bca96
registers.esp: 105965924
registers.edi: 39249564
registers.eax: 0
registers.ebp: 105965956
registers.edx: 98102304
registers.ebx: 1
registers.esi: 39249780
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 206 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000530000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3641000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cdb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000cc0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93edc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fa6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ecb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eeb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ec2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ffa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ffc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 31, 2023, 9:05 a.m.	process_identifier: 1792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ffd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (9 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ckpaelocniggkheibcacecnmmlmeodfa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn

Creates a suspicious process (1 event)

cmdline

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0019fc00', u'virtual_address': u'0x00002000', u'entropy': 7.878938298660679, u'name': u'.text', u'virtual_size': u'0x0019fb10'}

entropy

7.87893829866

description

A section with a high entropy has been found

entropy

0.852383393132

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 31, 2023, 9:05 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (9 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 102 events)

Time & API	Arguments	Status
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000420 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: 7-Zip base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: AddressBook base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: Adobe AIR base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: Connection Manager base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: EditPlus base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: Fontcore base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: Google Chrome base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: IE40 base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: IE4Data base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: IEData base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: Office15.PROPLUSR base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: WIC base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExW May 31, 2023, 9:13 a.m.	regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x00000420 key_handle: 0x00000424 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Created a process named as a common system process (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2680 thread_handle: 0x00000000000002d8 process_identifier: 2676 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002d4	1	1	0

Terminates another process (18 events)

Time & API	Arguments	Status
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2532 process_handle: 0x00000000000002bc
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2532 process_handle: 0x00000000000002bc	1
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2568 process_handle: 0x00000000000002c8
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2568 process_handle: 0x00000000000002c8	1
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2604 process_handle: 0x00000000000002d0
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2604 process_handle: 0x00000000000002d0	1
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2640 process_handle: 0x00000000000002d8
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2640 process_handle: 0x00000000000002d8	1
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2676 process_handle: 0x00000000000002e0
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2676 process_handle: 0x00000000000002e0	1
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2712 process_handle: 0x00000000000002e8
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2712 process_handle: 0x00000000000002e8	1
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2748 process_handle: 0x00000000000002f0
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2748 process_handle: 0x00000000000002f0	1
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2784 process_handle: 0x00000000000002f8
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2784 process_handle: 0x00000000000002f8	1
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2820 process_handle: 0x0000000000000300
NtTerminateProcess May 31, 2023, 9:06 a.m.	status_code: 0xffffffff process_identifier: 2820 process_handle: 0x0000000000000300	1

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: a19b13a9bb4286f4fb5c6bbd60c79ec2ee71113f

Communicates with host for which no DNS query was performed (1 event)

host

162.55.188.246

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 31, 2023, 9:06 a.m.	process_identifier: 2856 region_size: 868352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000002fc	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 31, 2023, 9:13 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

AddInProcess32.exe tried to sleep 5456503 seconds, actually delayed analysis time by 5456503 seconds

Collects information about installed applications (50 out of 76 events)

Time & API	Arguments	Status
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x00000424 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW May 31, 2023, 9:13 a.m.	key_handle: 0x000004b4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1792 resumed a thread in remote process 2856
NtResumeThread May 31, 2023, 9:06 a.m.	thread_handle: 0x0000000000000300 suspend_count: 1 process_identifier: 2856	1	0	0

Executed a process and injected code into it, probably while unpacking (35 events)

Time & API	Arguments	Status	Return
NtResumeThread May 31, 2023, 9:05 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread May 31, 2023, 9:05 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread May 31, 2023, 9:05 a.m.	thread_handle: 0x0000000000000178 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread May 31, 2023, 9:05 a.m.	thread_handle: 0x00000000000001e4 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread May 31, 2023, 9:05 a.m.	thread_handle: 0x0000000000000238 suspend_count: 1 process_identifier: 1792	1	0
NtResumeThread May 31, 2023, 9:05 a.m.	thread_handle: 0x0000000000000290 suspend_count: 1 process_identifier: 1792	1	0
NtGetContextThread May 31, 2023, 9:05 a.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread May 31, 2023, 9:05 a.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 1792	1	0
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2536 thread_handle: 0x00000000000002a8 process_identifier: 2532 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002ac	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2572 thread_handle: 0x00000000000002bc process_identifier: 2568 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002c0	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2608 thread_handle: 0x00000000000002c8 process_identifier: 2604 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002c4	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2644 thread_handle: 0x00000000000002d0 process_identifier: 2640 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002cc	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2680 thread_handle: 0x00000000000002d8 process_identifier: 2676 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002d4	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2716 thread_handle: 0x00000000000002e0 process_identifier: 2712 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002dc	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2752 thread_handle: 0x00000000000002e8 process_identifier: 2748 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002e4	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2788 thread_handle: 0x00000000000002f0 process_identifier: 2784 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002ec	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2824 thread_handle: 0x00000000000002f8 process_identifier: 2820 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002f4	1	1
CreateProcessInternalW May 31, 2023, 9:06 a.m.	thread_identifier: 2860 thread_handle: 0x0000000000000300 process_identifier: 2856 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000000000002fc	1	1
NtAllocateVirtualMemory May 31, 2023, 9:06 a.m.	process_identifier: 2856 region_size: 868352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000000000002fc	1	0
NtResumeThread May 31, 2023, 9:06 a.m.	thread_handle: 0x0000000000000300 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000250 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x000002b0 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000380 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000394 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000404 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000438 suspend_count: 1 process_identifier: 2856	1	0
NtGetContextThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000380	1	0
NtGetContextThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000380	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000380 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:13 a.m.	thread_handle: 0x00000480 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:14 a.m.	thread_handle: 0x00000178 suspend_count: 1 process_identifier: 2856	1	0
NtResumeThread May 31, 2023, 9:14 a.m.	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 2856	1	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.432887
FireEye	Gen:Variant.Barys.432887
ALYac	Gen:Variant.Barys.432887
Sangfor	Trojan.Msil.Agent.V6qb
CrowdStrike	win/malicious_confidence_70% (W)
Arcabit	Trojan.Barys.D69AF7
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan-PSW.MSIL.Reline.gen
BitDefender	Gen:Variant.Barys.432887
Avast	Win64:MalwareX-gen [Trj]
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/AD.BadNetLdr.apiln
VIPRE	Gen:Variant.Barys.432887
TrendMicro	TrojanSpy.Win64.REDLINE.YXDE4Z
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Barys.432887 (B)
Webroot	W32.Malware.Gen
Avira	TR/AD.BadNetLdr.apiln
Gridinsoft	Trojan.Win64.Gen.bot
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Reline.gen
GData	MSIL.Packed.Injector.D8D3RF
Google	Detected
McAfee	Artemis!FC370061296A
MAX	malware (ai score=83)
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win64.REDLINE.YXDE4Z
Ikarus	Trojan.BadNetLdr
Fortinet	PossibleThreat
AVG	Win64:MalwareX-gen [Trj]
Cybereason	malicious.1296ae
DeepInstinct	MALICIOUS

tcpupdate.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All