Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 30, 2021, 9:14 a.m.	March 30, 2021, 9:16 a.m.

Size	579.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`f13e6e958f4764b269daa240a747c845`
SHA256	`006e592f760a87219ad92ca26582ac07d3b3e71f9f529396266c310e893e634e`
CRC32	`BB6B43B9`
ssdeep	`12288:Gt+D1yz/1SXpqDaoWmwsFRHk3eBWIc/d:GcA1aLoBHgeBjc/d`
PDB Path	c:\House\842\hear-Dark\Than-Death\often.pdb
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero network_http - Communications over HTTP network_tcp_socket - Communications over RAW socket win_files_operation - Affect private profile Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration Str_Win32_Wininet_Library - Match Windows Inet API library declaration Str_Win32_Internet_API - Match Windows Inet API call Str_Win32_Http_API - Match Windows Http API call IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\t37dwfat.zip.dll,DllRegisterServer
5580
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\t37dwfat.zip.dll,Howgray
812
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\t37dwfat.zip.dll,Lostslave
5096
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\t37dwfat.zip.dll,Playtalk
6116
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\t37dwfat.zip.dll,Yellownext
4836
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\t37dwfat.zip.dll,
4672

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
210.65.244.176	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49818 -> 210.65.244.176:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49818 210.65.244.176:443	C=BL, ST=Atyho Aininsu1 olupl, L=Saint, O=doublebarrowfulSE, CN=Pithe-dwial.mz	C=BL, ST=Atyho Aininsu1 olupl, L=Saint, O=doublebarrowfulSE, CN=Pithe-dwial.mz	bf:3a:1f:85:42:55:48:1f:6a:81:9e:80:e1:9c:5e:9d:69:78:7b:42

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 30, 2021, 9:15 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 30, 2021, 9:15 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

This executable has a PDB path (1 event)

pdb_path

c:\House\842\hear-Dark\Than-Death\often.pdb

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

One or more processes crashed (50 out of 30833 events)

Time & API	Arguments	Status
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896816 registers.edi: 2108936 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 8652752 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 8652768 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 8652784 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 8652800 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 8652816 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 8652832 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 8652848 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 8652864 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 8652880 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 8652896 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8652912 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 8652928 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 8652944 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 8652960 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 8652976 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896792 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 8652992 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: DllRegisterServer+0xcbc7 t37dwfat+0x16937 @ 0x6f6f6937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1895992 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 1897060 registers.edx: 23 registers.ebx: 1897076 registers.esi: 23 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897044 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 8656232 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 8656256 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 8656280 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 8656304 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 8656328 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 8656352 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 8656376 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 8656400 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 8656424 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 8656448 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 8656472 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 8656496 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 8656520 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 8656544 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 8656568 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897020 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 8656592 registers.ecx: 0	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: rundll32+0x1326 @ 0xf41326 rundll32+0x1901 @ 0xf41901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: cc c3 33 c0 a3 b5 b1 71 6f a3 ad b1 71 6f a3 b1 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer-0x4bf5 t37dwfat+0x517b exception.address: 0x6f6e517b registers.esp: 1898352 registers.edi: 0 registers.eax: 1971153576 registers.ebp: 1899004 registers.edx: 101 registers.ebx: 0 registers.esi: 5308536 registers.ecx: 11	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1898304 registers.edi: 0 registers.eax: 2000478246 registers.ebp: 1898600 registers.edx: 1 registers.ebx: 10240 registers.esi: 10240 registers.ecx: 8656232	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 c3 0f 1f 80 00 00 00 00 0f 1f 80 00 00 00 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x735f t37dwfat+0x110cf exception.address: 0x6f6f10cf registers.esp: 1898288 registers.edi: 8657784 registers.eax: 2000478085 registers.ebp: 1898600 registers.edx: 112 registers.ebx: 10240 registers.esi: 10240 registers.ecx: 11	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897500 registers.edi: 0 registers.eax: 2000478246 registers.ebp: 1898256 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 8656232	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897500 registers.edi: 0 registers.eax: 2000478246 registers.ebp: 1898264 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 8656232	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: DllRegisterServer+0xcf0f t37dwfat+0x16c7f @ 0x6f6f6c7f exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1897064 registers.edi: 0 registers.eax: 2000478246 registers.ebp: 1897540 registers.edx: 0 registers.ebx: 0 registers.esi: 169797019 registers.ecx: 8656232	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: DllRegisterServer+0xcf0f t37dwfat+0x16c7f @ 0x6f6f6c7f exception.instruction_r: cc c3 8b 3d f0 b1 71 6f 8b 74 24 20 8b 54 24 18 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x9c8a t37dwfat+0x139fa exception.address: 0x6f6f39fa registers.esp: 1897084 registers.edi: 1897108 registers.eax: 1970477797 registers.ebp: 1897540 registers.edx: 87 registers.ebx: 0 registers.esi: 1970405376 registers.ecx: 13	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: DllRegisterServer+0xcf0f t37dwfat+0x16c7f @ 0x6f6f6c7f exception.instruction_r: cc c3 e9 14 f9 ff ff 8b 44 10 14 85 c0 75 e9 eb exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xb259 t37dwfat+0x14fc9 exception.address: 0x6f6f4fc9 registers.esp: 1897020 registers.edi: 8751424 registers.eax: 1970475456 registers.ebp: 1897540 registers.edx: 114 registers.ebx: 1970405376 registers.esi: 1970405376 registers.ecx: 12	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec t37dwfat+0x1105c exception.address: 0x6f6f105c registers.esp: 1896972 registers.edi: 8751424 registers.eax: 2000478246 registers.ebp: 1897020 registers.edx: 1 registers.ebx: 316 registers.esi: 320 registers.ecx: 8656232	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 c3 0f 1f 80 00 00 00 00 0f 1f 80 00 00 00 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x735f t37dwfat+0x110cf exception.address: 0x6f6f10cf registers.esp: 1896956 registers.edi: 8751480 registers.eax: 2000478085 registers.ebp: 1897020 registers.edx: 0 registers.ebx: 316 registers.esi: 320 registers.ecx: 8656232	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 85 c0 0f 85 dd 00 00 00 45 3b 2e 0f 82 76 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xadb8 t37dwfat+0x14b28 exception.address: 0x6f6f4b28 registers.esp: 1897012 registers.edi: 8751424 registers.eax: 1967472907 registers.ebp: 0 registers.edx: 100 registers.ebx: 1967390720 registers.esi: 8751480 registers.ecx: 8	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 85 c0 0f 85 dd 00 00 00 45 3b 2e 0f 82 76 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xadb8 t37dwfat+0x14b28 exception.address: 0x6f6f4b28 registers.esp: 1897012 registers.edi: 8751424 registers.eax: 1967472907 registers.ebp: 1 registers.edx: 8656232 registers.ebx: 0 registers.esi: 8751480 registers.ecx: 10	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 85 c0 0f 85 dd 00 00 00 45 3b 2e 0f 82 76 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xadb8 t37dwfat+0x14b28 exception.address: 0x6f6f4b28 registers.esp: 1897012 registers.edi: 8751424 registers.eax: 1967472907 registers.ebp: 2 registers.edx: 8656232 registers.ebx: 0 registers.esi: 8751480 registers.ecx: 10	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 85 c0 0f 85 dd 00 00 00 45 3b 2e 0f 82 76 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xadb8 t37dwfat+0x14b28 exception.address: 0x6f6f4b28 registers.esp: 1897012 registers.edi: 8751424 registers.eax: 1967472907 registers.ebp: 3 registers.edx: 8656232 registers.ebx: 0 registers.esi: 8751480 registers.ecx: 10	1
__exception__ March 30, 2021, 9:15 a.m.	stacktrace: exception.instruction_r: cc c3 8d 0c 24 e8 69 48 01 00 80 7c 24 2c 00 74 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xaf2d t37dwfat+0x14c9d exception.address: 0x6f6f4c9d registers.esp: 1897016 registers.edi: 8751424 registers.eax: 1967472942 registers.ebp: 1967390720 registers.edx: 100 registers.ebx: 2234760 registers.esi: 1970405376 registers.ecx: 7	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST https://210.65.244.176/

Performs some HTTP requests (1 event)

request

POST https://210.65.244.176/

Sends data using the HTTP POST Method (1 event)

request

POST https://210.65.244.176/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 54 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f72e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f771000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f72e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f771000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 812 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00900000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f72e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 5096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f771000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5096 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5096 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 5096 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 6116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f72e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 6116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 6116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 6116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 6116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 6116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f771000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 6116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 6116 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:15 a.m.	process_identifier: 6116 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 4836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f72e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 4836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 4836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 4836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:14 a.m.	process_identifier: 4836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 events)

FireEye	Generic.mg.f13e6e958f4764b2
McAfee	Artemis!F13E6E958F47
APEX	Malicious
McAfee-GW-Edition	Artemis!Trojan
Rising	Malware.Heuristic!ET#76% (RDMK:cmRtazq5NSPi1f1rti9UugitAC2B)

Queries for potentially installed applications (50 out of 68 events)

Time & API	Arguments	Status
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: 7-Zip base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: AddressBook base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: Connection Manager base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: DirectDrawEx base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: Fontcore base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: HashTab base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: IE40 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: IE4Data base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: IE5BAKEX base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: IEData base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: MobileOptionPack base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: MozillaMaintenanceService base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: SchedulingAgent base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: WIC base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F86417051FF} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86417051FF}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {90120000-0028-0412-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-1000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {90120000-002A-0000-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0000-1000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {90120000-002A-0409-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0409-1000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {90120000-002A-0412-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0412-1000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: 7-Zip base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: AddressBook base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: Connection Manager base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: EditPlus base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: ENTERPRISE base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: Fontcore base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: Google Chrome base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: IE40 base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: IE4Data base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: IEData base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: WIC base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:15 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	210.65.244.176

Collects information about installed applications (44 events)

Time & API	Arguments	Status
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 19.00 (x64) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HashTab 6.0.0.34 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Maintenance Service regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 7 Update 51 (64-bit) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86417051FF}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 KOR Language Pack regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 x64 Minimum Runtime - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Office 64-bit Components 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0000-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared 64-bit MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0409-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared 64-bit MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0412-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 한국어 언어 팩 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Python 2.7.18 (64-bit) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 x64 Additional Runtime - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:15 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (1 event)

Time & API	Arguments	Status	Return	Repeated
CryptHashData March 30, 2021, 9:15 a.m.	buffer: TEST22-PCtest22f¦rZ hash_handle: 0x0021c828 flags: 0	1	1	0

t37dwfat.zip

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All