Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 30, 2021, 9:18 a.m.	March 30, 2021, 9:23 a.m.

Size	368.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`44dcdfd1873198f50c5dd4dbb1fe8f44`
SHA256	`ae3b7d160b7b7389b413ad2cc8787f5b92013627476a1cb2a3371712b07cd28e`
CRC32	`1ED730D3`
ssdeep	`6144:WbazNBbycfmKsyUlVkMdUFIk1KyHNwoATpFp5xM8C1h:NzeTlVk/7HNQp5W8Uh`
PDB Path	c:\print-length\763_Pound\Create_Spot\connect\Once.pdb
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero win_files_operation - Affect private profile IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\n7duez.zip.dll,Bearnight
6192
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\n7duez.zip.dll,DllRegisterServer
3500
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\n7duez.zip.dll,Inchcamp
3800
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\n7duez.zip.dll,Surewhat
6892
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\n7duez.zip.dll,Trueparent
7772
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\n7duez.zip.dll,
6744

Name	Response	Post-Analysis Lookup
edgedl.gvt1.com	A 142.250.34.2	142.250.34.2

IP Address	Status	Action
142.250.34.2	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
210.65.244.176	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49819 -> 210.65.244.176:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.102:49820 -> 172.217.24.67:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49827 -> 172.217.24.67:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49826 -> 172.217.24.67:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 142.250.34.2:80 -> 192.168.56.102:49821	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 142.250.34.2:80 -> 192.168.56.102:49821	2014520	ET INFO EXE - Served Attached HTTP	Misc activity
TCP 142.250.34.2:80 -> 192.168.56.102:49821	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49819 210.65.244.176:443	C=BL, ST=Atyho Aininsu1 olupl, L=Saint, O=doublebarrowfulSE, CN=Pithe-dwial.mz	C=BL, ST=Atyho Aininsu1 olupl, L=Saint, O=doublebarrowfulSE, CN=Pithe-dwial.mz	bf:3a:1f:85:42:55:48:1f:6a:81:9e:80:e1:9c:5e:9d:69:78:7b:42
TLS 1.2 192.168.56.102:49820 172.217.24.67:443	C=US, O=Google Trust Services, CN=GTS CA 1O1	C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com	4f:cf:dd:03:b1:91:8c:80:31:c6:81:55:56:99:09:8d:2e:99:33:f0
TLS 1.2 192.168.56.102:49827 172.217.24.67:443	C=US, O=Google Trust Services, CN=GTS CA 1O1	C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com	4f:cf:dd:03:b1:91:8c:80:31:c6:81:55:56:99:09:8d:2e:99:33:f0
TLS 1.2 192.168.56.102:49826 172.217.24.67:443	C=US, O=Google Trust Services, CN=GTS CA 1O1	C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com	4f:cf:dd:03:b1:91:8c:80:31:c6:81:55:56:99:09:8d:2e:99:33:f0

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 30, 2021, 9:19 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 30, 2021, 9:19 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

This executable has a PDB path (1 event)

pdb_path

c:\print-length\763_Pound\Create_Spot\connect\Once.pdb

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

One or more processes crashed (50 out of 30833 events)

Time & API	Arguments	Status
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486472 registers.edi: 6892504 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 12715984 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 12716000 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 12716016 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 12716032 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 12716048 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 12716064 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 12716080 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 12716096 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 12716112 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 12716128 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12716144 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 12716160 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 12716176 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 12716192 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 12716208 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486448 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 12716224 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: DllRegisterServer+0xcbc7 n7duez+0x16937 @ 0x6f776937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2485640 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 2486716 registers.edx: 23 registers.ebx: 2486732 registers.esi: 23 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486700 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 12719464 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 12719488 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 12719512 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 12719536 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 12719560 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 12719584 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 12719608 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 12719632 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 12719656 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 12719680 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 12719704 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 12719728 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 12719752 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 12719776 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 12719800 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 2486676 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 12719824 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765712 registers.edi: 6564728 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 9111504 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 9111520 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 9111536 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 9111552 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 9111568 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 9111584 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 9111600 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 9111616 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 9111632 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 9111648 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9111664 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 9111680 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 9111696 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 30, 2021, 9:19 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec n7duez+0x1105c exception.address: 0x6f77105c registers.esp: 1765688 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 9111712 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST https://210.65.244.176/
suspicious_features	POST method with no referer header	suspicious_request	POST https://update.googleapis.com/service/update2?cup2key=10:1063268346&cup2hreq=aeb1fd103607563a549a6ba2077d24749f8c33da6854c0de7ef1993f7b40cbea
suspicious_features	POST method with no referer header	suspicious_request	POST https://update.googleapis.com/service/update2

Performs some HTTP requests (5 events)

request	HEAD http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
request	GET http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
request	POST https://210.65.244.176/
request	POST https://update.googleapis.com/service/update2?cup2key=10:1063268346&cup2hreq=aeb1fd103607563a549a6ba2077d24749f8c33da6854c0de7ef1993f7b40cbea
request	POST https://update.googleapis.com/service/update2

Sends data using the HTTP POST Method (3 events)

request	POST https://210.65.244.176/
request	POST https://update.googleapis.com/service/update2?cup2key=10:1063268346&cup2hreq=aeb1fd103607563a549a6ba2077d24749f8c33da6854c0de7ef1993f7b40cbea
request	POST https://update.googleapis.com/service/update2

Allocates read-write-execute memory (usually to unpack itself) (37 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 30, 2021, 9:18 a.m.	process_identifier: 6192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcbe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 6192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f7bb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 6192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 6192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 6192 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:18 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcbe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f7bb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3500 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:18 a.m.	process_identifier: 3800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcbe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3800 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f7bb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3800 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 3800 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:18 a.m.	process_identifier: 6892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcbe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 6892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f7bb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 6892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 6892 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:18 a.m.	process_identifier: 7772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fcbe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 7772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f7bb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 7772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 7772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 30, 2021, 9:19 a.m.	process_identifier: 7772 region_size: 548864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Queries for potentially installed applications (50 out of 68 events)

Time & API	Arguments	Status
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: 7-Zip base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: AddressBook base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: Connection Manager base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: DirectDrawEx base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: Fontcore base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: HashTab base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: IE40 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: IE4Data base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: IE5BAKEX base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: IEData base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: MobileOptionPack base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: MozillaMaintenanceService base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: SchedulingAgent base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: WIC base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F86417051FF} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86417051FF}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {90120000-0028-0412-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-1000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {90120000-002A-0000-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0000-1000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {90120000-002A-0409-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0409-1000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {90120000-002A-0412-1000-0000000FF1CE} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0412-1000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042 base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04} base_handle: 0x0000012c key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000130 options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: 7-Zip base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: AddressBook base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: Connection Manager base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: EditPlus base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: ENTERPRISE base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: Fontcore base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: Google Chrome base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: IE40 base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: IE4Data base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: IEData base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: WIC base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW March 30, 2021, 9:19 a.m.	regkey_r: {90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000130 key_handle: 0x0000012c options: 0 access: 0x00020109 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	210.65.244.176

Collects information about installed applications (44 events)

Time & API	Arguments	Status
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 19.00 (x64) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HashTab 6.0.0.34 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Maintenance Service regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 7 Update 51 (64-bit) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86417051FF}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 KOR Language Pack regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 x64 Minimum Runtime - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Office 64-bit Components 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0000-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared 64-bit MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0409-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared 64-bit MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002A-0412-1000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft .NET Framework 4.5 한국어 언어 팩 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Python 2.7.18 (64-bit) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x00000130 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 x64 Additional Runtime - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW March 30, 2021, 9:19 a.m.	key_handle: 0x0000012c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.44dcdfd1873198f5
Cylance	Unsafe
BitDefenderTheta	Gen:NN.ZedlaF.34654.xq4@aiZVwwg
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
AegisLab	Trojan.Win32.Cridex.7!c
McAfee-GW-Edition	BehavesLike.Win32.Generic.fh
Kingsoft	Win32.Troj.Banker.(kcloud)
Cynet	Malicious (score: 100)
McAfee	GenericRXAA-AA!44DCDFD18731

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (1 event)

Time & API	Arguments	Status	Return	Repeated
CryptHashData March 30, 2021, 9:19 a.m.	buffer: TEST22-PCtest22f¦rZ hash_handle: 0x0066c0d0 flags: 0	1	1	0

n7duez.zip

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All