Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 21, 2024, 9:56 a.m.	July 21, 2024, 9:59 a.m.

Size	1.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`60697ecdf48bd911582ccd71c115dd21`
SHA256	`007be8197ac56659de05ef2ccdb897577fa72212e46131a79861c913beb38a99`
CRC32	`28077975`
ssdeep	`24576:g1UGLrmwPVsjEkazzCmzpslRI4/iK6LfGJErGCkfp0sUPYud9mj1uRyRskdr:gu2jkaqmzpwOOiMeGPfp0sUPYu7UQqfr`
Yara	Malicious_Library_Zero - Malicious_Library Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer Antivirus - Contains references to security software IsPE32 - (no description) UPX_Zero - UPX packed file Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

tomcat.exe "C:\Users\test22\AppData\Local\Temp\tomcat.exe"
2556
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
206.238.197.185	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 21, 2024, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 21, 2024, 9:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 21, 2024, 9:56 a.m.	computer_name: TEST22-PC	1	1

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 21, 2024, 9:56 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 539 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10000000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ea1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ee0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ee0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03080000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03260000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x033d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03410000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x035c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (49 events)

Time & API	Arguments	Status	Return
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: mobsync.exe process_identifier: 2284	1	1
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: pw.exe process_identifier: 2328	1	1
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: taskhost.exe process_identifier: 2364	1	1
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: sdclt.exe process_identifier: 2380	1	1
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: tomcat.exe process_identifier: 2556	1	1
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: tomc磰i.e process_identifier: 46		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000000f0 process_name: tomc磰i.e process_identifier: 75		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: tomc磰i.e process_identifier: 104		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000000f0 process_name: tomc磰i.e process_identifier: 133		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: tomc磰i.e process_identifier: 162		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000000f0 process_name: tomc磰i.e process_identifier: 191		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000120 process_name: schtasks.exe process_identifier: 2620	1	1
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000120 process_name: conhost.exe process_identifier: 2628	1	1
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000120 process_name: conh磰it. process_identifier: 229		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002cc process_name: conh磰it. process_identifier: 77		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002e8 process_name: conh磰it. process_identifier: 118		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002d4 process_name: conh磰it. process_identifier: 149		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002e8 process_name: conh磰it. process_identifier: 180		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002d4 process_name: conh磰it. process_identifier: 211		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002e8 process_name: conh磰it. process_identifier: 242		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002d4 process_name: conh磰it. process_identifier: 273		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000300 process_name: conh磰it. process_identifier: 357		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002ec process_name: conh磰it. process_identifier: 388		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000300 process_name: conh磰it. process_identifier: 419		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002ec process_name: conh磰it. process_identifier: 450		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000300 process_name: conh磰it. process_identifier: 481		0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002ec process_name: conh磰it. process_identifier: 512		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: tomc磰i.e process_identifier: 44		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x000002d4 process_name: tomc磰i.e process_identifier: 590		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: tomc磰i.e process_identifier: 616		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x000002d4 process_name: tomc磰i.e process_identifier: 642		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: tomc磰i.e process_identifier: 668		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x000002d4 process_name: tomc磰i.e process_identifier: 694		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: tomc磰i.e process_identifier: 720		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x0000023c process_name: taskhost.exe process_identifier: 2976	1	1
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x0000023c process_name: task磰ist process_identifier: 758		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: task磰ist process_identifier: 794		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x0000023c process_name: task磰ist process_identifier: 821		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: task磰ist process_identifier: 848		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x0000023c process_name: task磰ist process_identifier: 875		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: task磰ist process_identifier: 902		0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000288 process_name: task磰ist process_identifier: 929		0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svchost.exe process_identifier: 800	1	1
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svch磰it. process_identifier: 971		0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x00000288 process_name: svch磰it. process_identifier: 1008		0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svch磰it. process_identifier: 1036		0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x00000288 process_name: svch磰it. process_identifier: 1064		0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svch磰it. process_identifier: 1092		0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svch磰it. process_identifier: 1148		0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 21, 2024, 9:56 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 16384 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02851000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x000bcc00', u'virtual_address': u'0x0007e000', u'entropy': 7.446838368190031, u'name': u'.data', u'virtual_size': u'0x000dc55c'}

entropy

7.44683836819

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00018600', u'virtual_address': u'0x00164000', u'entropy': 7.9857477346195305, u'name': u'.rsrc', u'virtual_size': u'0x00018558'}

entropy

7.98574773462

description

A section with a high entropy has been found

entropy

0.618650217707

description

Overall entropy of this PE file is high

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (40 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: tomc磰i.e process_identifier: 46		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000000f0 process_name: tomc磰i.e process_identifier: 75		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: tomc磰i.e process_identifier: 104		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000000f0 process_name: tomc磰i.e process_identifier: 133		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000118 process_name: tomc磰i.e process_identifier: 162		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000000f0 process_name: tomc磰i.e process_identifier: 191		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002cc process_name: conh磰it. process_identifier: 77		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002e8 process_name: conh磰it. process_identifier: 118		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002d4 process_name: conh磰it. process_identifier: 149		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002e8 process_name: conh磰it. process_identifier: 180		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002d4 process_name: conh磰it. process_identifier: 211		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002e8 process_name: conh磰it. process_identifier: 242		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002d4 process_name: conh磰it. process_identifier: 273		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000300 process_name: conh磰it. process_identifier: 357		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002ec process_name: conh磰it. process_identifier: 388		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000300 process_name: conh磰it. process_identifier: 419		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002ec process_name: conh磰it. process_identifier: 450		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x00000300 process_name: conh磰it. process_identifier: 481		0	0
Process32NextW July 21, 2024, 9:56 a.m.	snapshot_handle: 0x000002ec process_name: conh磰it. process_identifier: 512		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: tomc磰i.e process_identifier: 44		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x000002d4 process_name: tomc磰i.e process_identifier: 590		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: tomc磰i.e process_identifier: 616		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x000002d4 process_name: tomc磰i.e process_identifier: 642		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: tomc磰i.e process_identifier: 668		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x000002d4 process_name: tomc磰i.e process_identifier: 694		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: tomc磰i.e process_identifier: 720		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x0000023c process_name: task磰ist process_identifier: 758		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: task磰ist process_identifier: 794		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x0000023c process_name: task磰ist process_identifier: 821		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: task磰ist process_identifier: 848		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x0000023c process_name: task磰ist process_identifier: 875		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000240 process_name: task磰ist process_identifier: 902		0	0
Process32NextW July 21, 2024, 9:57 a.m.	snapshot_handle: 0x00000288 process_name: task磰ist process_identifier: 929		0	0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svch磰it. process_identifier: 971		0	0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x00000288 process_name: svch磰it. process_identifier: 1008		0	0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svch磰it. process_identifier: 1036		0	0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x00000288 process_name: svch磰it. process_identifier: 1064		0	0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svch磰it. process_identifier: 1092		0	0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x00000288 process_name: svch磰it. process_identifier: 1120		0	0
Process32NextW July 21, 2024, 9:58 a.m.	snapshot_handle: 0x0000023c process_name: svch磰it. process_identifier: 1148		0	0

Queries for potentially installed applications (50 out of 84 events)

Time & API	Arguments	Status
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000002ec options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000002f0 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExA July 21, 2024, 9:56 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x000002f4 options: 0 access: 0x02000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1

Communicates with host for which no DNS query was performed (1 event)

host

206.238.197.185

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WPS.lnk

Collects information about installed applications (16 events)

Time & API	Arguments	Status
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExA July 21, 2024, 9:56 a.m.	key_handle: 0x000002f4 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.BlackMoon.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Jaik.226535
Cylance	Unsafe
VIPRE	Gen:Variant.Jaik.226535
Sangfor	Trojan.Win32.Save.BlackMoon
BitDefender	Gen:Variant.Jaik.226535
K7GW	Trojan ( 005931081 )
Cybereason	malicious.df48bd
Arcabit	Trojan.Jaik.D374E7
VirIT	Trojan.Win32.GenusT.DXGH
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Packed.BlackMoon.A suspicious
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Dropper.Tiggre-9845940-0
Kaspersky	HEUR:Trojan.Win32.Zenpak.gen
NANO-Antivirus	Trojan.Win32.BlackMoon.kokgmk
MicroWorld-eScan	Gen:Variant.Jaik.226535
Rising	Trojan.BlackMoon!8.1980E (TFE:5:W2Bdxtm86PF)
Emsisoft	Gen:Variant.Jaik.226535 (B)
DrWeb	Trojan.MulDrop27.43603
Zillya	Trojan.Zenpak.Win32.23853
McAfeeD	Real Protect-LS!60697ECDF48B
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.60697ecdf48bd911
Ikarus	Trojan.Crypt
Google	Detected
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Win32.Blamon.a
Microsoft	Trojan:Win32/BlackMoon.Z!MTB
ZoneAlarm	HEUR:Trojan.Win32.Zenpak.gen
GData	Win32.Trojan.PSE.1DPEYYJ
AhnLab-V3	Trojan/Win.BlackMoon.R652645
BitDefenderTheta	Gen:NN.ZexaF.36806.wv2@aKGAqydi
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Downloader
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/GdSda.A
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Agent.WP!tr
AVG	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (D)

tomcat.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All