popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

slyla0.tar

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 1, 2021, 9:20 a.m. April 1, 2021, 9:37 a.m.
Size 381.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 0a93401ba77815b37c6301abdd7dc528
SHA256 51fc19f8dd98ece514232b2db2f5fa918f279ec2209597d0c9a6f95ea9311663
CRC32 C9F3A9D3
ssdeep 6144:m6vYH/guLTgMb1oFtIaJmGDtDplcJqiD4IU2fQ/TxHu+trHayYm:m6vYouLTgM5oFt/hRDfkL1U2Y/TxO+tn
PDB Path paragraph.pdbVillagesdinghgaragraph#@db
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
edgedl.gvt1.com
A 142.250.34.2
142.250.34.2
IP Address Status Action
172.217.25.3 Active Moloch
142.250.34.2 Active Moloch
142.250.66.131 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
216.58.200.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path paragraph.pdbVillagesdinghgaragraph#@db
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028068
        

      
        registers.edi:
        8661720
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2000552521
        

      
        registers.edx:
        129161
        

      
        registers.ebx:
        2704346981
        

      
        registers.esi:
        1970405376
        

      
        registers.ecx:
        66040
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        16
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146256
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        15
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146272
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        14
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146288
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        13
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146304
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146320
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        11
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146336
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        10
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146352
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        9
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146368
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        8
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146384
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        7
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146400
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146416
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        5
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146432
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        4
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146448
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        3
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146464
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        2
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146480
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028044
        

      
        registers.edi:
        1
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34146496
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          
DllRegisterServer+0xcbc7 slyla0+0x16937 @ 0x73806937

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2027240
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2028312
        

      
        registers.edx:
        23
        

      
        registers.ebx:
        2028328
        

      
        registers.esi:
        23
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028296
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        96784
        

      
        registers.edx:
        827898
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        282
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        16
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149736
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        15
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149760
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        14
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149784
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        13
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149808
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        12
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149832
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        11
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149856
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149880
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        9
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149904
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        8
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149928
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        7
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149952
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        6
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34149976
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        5
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34150000
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34150024
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        3
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34150048
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34150072
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        2028272
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        1
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        34150096
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782444
        

      
        registers.edi:
        2763496
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2000552521
        

      
        registers.edx:
        129161
        

      
        registers.ebx:
        2704346981
        

      
        registers.esi:
        1970405376
        

      
        registers.ecx:
        66040
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        16
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918032
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        15
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918048
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        14
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918064
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        13
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918080
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918096
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        11
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918112
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        10
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918128
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        9
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918144
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        8
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918160
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        7
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918176
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918192
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        5
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918208
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        4
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918224
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec slyla0+0x1105c
        

      
        exception.address:
        0x7380105c
        

      
    
  
    
      
        registers.esp:
        782420
        

      
        registers.edi:
        3
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        31918240
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            suspicious_features
                                            POST method with no referer header
                                        
                                    
                                        
                                    
                                        
                                            suspicious_request
                                            POST https://update.googleapis.com/service/update2?cup2key=10:480555301&cup2hreq=b80a2af7daed8b780ff89dc8715ac20874a4399172450b9710e682e39b0c9a7b
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                            suspicious_features
                                            POST method with no referer header
                                        
                                    
                                        
                                    
                                        
                                            suspicious_request
                                            POST https://update.googleapis.com/service/update2
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    request
                                    HEAD http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
                                    
                                


                            

                        

                            

                                

                                    request
                                    GET http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
                                    
                                


                            

                        

                            

                                

                                    request
                                    POST https://update.googleapis.com/service/update2?cup2key=10:480555301&cup2hreq=b80a2af7daed8b780ff89dc8715ac20874a4399172450b9710e682e39b0c9a7b
                                    
                                


                            

                        

                            

                                

                                    request
                                    POST https://update.googleapis.com/service/update2
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    request
                                    POST https://update.googleapis.com/service/update2?cup2key=10:480555301&cup2hreq=b80a2af7daed8b780ff89dc8715ac20874a4399172450b9710e682e39b0c9a7b
                                    
                                


                            

                        

                            

                                

                                    request
                                    POST https://update.googleapis.com/service/update2
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1836
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73831000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1836
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73850000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1836
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00360000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1836
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00370000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1836
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x01d10000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          7768
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73831000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          7768
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73850000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          7768
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00810000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          7768
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00820000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          7768
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00830000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          5980
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73831000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          5980
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73850000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          5980
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          5980
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003d0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          5980
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003f0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          4452
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73831000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          4452
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73850000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          4452
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00810000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          4452
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00820000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          4452
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00830000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetect.malware2
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.0a93401ba77815b3
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    VHO:Trojan-Dropper.Win32.Roxer.gen
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Program:Win32/Wacapew.C!ml
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan-Dropper.VBA.Agent
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0003f600', u'virtual_address': u'0x00001000', u'entropy': 6.832595727434939, u'name': u'.text', u'virtual_size': u'0x0003f474'}
                                        
                                    
                                        
                                            entropy
                                            6.83259572743
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.666228646518
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            host
                                            172.217.25.3
                                        
                                    
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                            host
                                            142.250.66.131
                                        
                                    
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                            host
                                            172.217.25.14
                                        
                                    
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                            host
                                            216.58.200.14