popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

hBKKvc5PYJSJ.exe

PWS AntiDebug BitCoin PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
    Category Machine Started Completed
    FILE s1_win7_x6402 June 12, 2021, 12:41 p.m. June 12, 2021, 12:45 p.m.
    Size 178.4KB
    Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
    MD5 ea64fb745ef58010d1b9d7ac80f221d0
    SHA256 191a6c8951aa3bc73634891e7551a229e15fd90ff0deacef8a2f3a8594d53f6d
    CRC32 7406522A
    ssdeep 3072:F/KqI49cV1QZ+y+d8hKZVwhpxaVBxAx9u430BG+pV:FCiJ+d8hKb6a/S9EB9
    PDB Path @
    Yara
    • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
    • PE_Header_Zero - PE File Signature
    • Is_DotNET_EXE - (no description)
    • IsPE32 - (no description)

    Name Response Post-Analysis Lookup
    api.ip.sb
    CNAME api.ip.sb.cdn.cloudflare.net
    A 104.26.13.31
    A 104.26.12.31
    A 172.67.75.172
    		104.26.12.31
    IP Address Status Action
    104.26.12.31 Active Moloch
    164.124.101.2 Active Moloch
    172.217.25.14 Active Moloch
    185.241.61.33 Active Moloch

    Suricata Alerts

    Flow SID Signature Category
    TCP 192.168.56.102:49812 -> 104.26.12.31:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
    TCP 185.241.61.33:16195 -> 192.168.56.102:49811 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode

    Suricata TLS

    Flow Issuer Subject Fingerprint
    TLSv1
    192.168.56.102:49812
    104.26.12.31:443     		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 5e:7d:19:2d:d7:66:0c:63:45:a5:24:8f:b7:db:35:a7:61:6d:89:0e

    Time & API Arguments Status Return Repeated

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0
    Time & API Arguments Status Return Repeated

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0
    Time & API Arguments Status Return Repeated

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x0048f988
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x0048fa08
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x0048fa08
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x0048f948
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x0048f948
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x0048f948
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x00aa1510
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x00aa1510
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x00aa1550
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x00b4ef90
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x00b4ef90
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x00b4edd0
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0
    pdb_path @
    file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
    Time & API Arguments Status Return Repeated

    GlobalMemoryStatusEx

    		 1 1 0
    Time & API Arguments Status Return Repeated

    __exception__

    		 stacktrace: 
    0x805882
0x801001
0x8003ca
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6f502652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6f51264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6f512e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6f5c74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6f5c7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6f651dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6f651e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6f651f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6f65416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x743ef5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74467f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74464de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

    exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c
    exception.instruction: mov eax, dword ptr [ecx]
    exception.exception_code: 0xc0000005
    exception.symbol:
    exception.address: 0x805911
    registers.esp: 3928128
    registers.edi: 36111884
    registers.eax: 0
    registers.ebp: 3928152
    registers.edx: 10971256
    registers.ebx: 35553160
    registers.esi: 36112064
    registers.ecx: 0
    		1 0 0
    suspicious_features GET method with no useragent header suspicious_request GET https://api.ip.sb/geoip
    request GET https://api.ip.sb/geoip
    Time & API Arguments Status Return Repeated

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 655360
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00540000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x005a0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 2952
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6fba1000
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 2952
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x6fba2000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 1179648
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x006d0000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x007b0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00422000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00555000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0055b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00557000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0043c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00770000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0042a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0079f000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00790000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00771000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00546000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0054a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00547000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00772000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0043a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00773000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0042c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0054b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0043d000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0054c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00774000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00775000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00791000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00776000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0043e000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 8192
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00777000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00792000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00779000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00793000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0043f000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0077a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0077b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00548000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00794000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0077c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0077d000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00795000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0077e000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x04720000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x04721000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00796000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00797000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x04722000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2952
    region_size: 8192
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x04723000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
    Time & API Arguments Status Return Repeated

    GetAdaptersAddresses

    		 flags: 15
    family: 0
    		111 0
    Time & API Arguments Status Return Repeated

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeDebugPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeDebugPrivilege
    		1 1 0
    description Virtual currency rule Virtual_currency_Zero
    description (no description) rule DebuggerCheck__GlobalFlags
    description (no description) rule DebuggerCheck__QueryInfo
    description (no description) rule DebuggerHiding__Thread
    description (no description) rule DebuggerHiding__Active
    description (no description) rule ThreadControl__Context
    description (no description) rule SEH__vectored
    description Checks if being debugged rule anti_dbg
    description Bypass DEP rule disable_dep
    Time & API Arguments Status Return Repeated

    RegOpenKeyExW

    		 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    base_handle: 0x80000002
    key_handle: 0x000006a4
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: 7-Zip
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: AddressBook
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Connection Manager
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: DirectDrawEx
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: EditPlus
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: ENTERPRISE
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Fontcore
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Google Chrome
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Haansoft HWord 80 Korean
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: IE40
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: IE4Data
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: IE5BAKEX
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: IEData
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: MobileOptionPack
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko)
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: SchedulingAgent
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: WIC
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-0015-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-0016-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-0018-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-0019-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-001A-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-001B-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-001F-0409-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-001F-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-0028-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-002C-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-0030-0000-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-0044-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-006E-0409-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-006E-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-00A1-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-00BA-0409-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90120000-0114-0412-0000-0000000FF1CE}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d}
    base_handle: 0x000006a4
    key_handle: 0x000006a8
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}
    		1 0 0
    host 172.217.25.14
    host 185.241.61.33
    Time & API Arguments Status Return Repeated

    NtAllocateVirtualMemory

    		 process_identifier: 8232
    region_size: 114688
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00400000
    allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
    process_handle: 0x00000238
    		1 0 0
    file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
    file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
    Time & API Arguments Status Return Repeated

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: 7-Zip 20.02 alpha
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: EditPlus
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Enterprise 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Chrome
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: 한컴오피스 한글 2010
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Mozilla Thunderbird 78.4.0 (x86 ko)
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: HttpWatch Professional 9.3.39
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: 한컴오피스 한글 2010
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Google Update Helper
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Access MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Excel MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office PowerPoint MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Publisher MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Outlook MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Word MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Proof (English) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Proof (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office IME (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Proofing (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Enterprise 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office InfoPath MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Shared MUI (English) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Shared MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office OneNote MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Groove MUI (English) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Adobe Flash Player 13 ActiveX
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Adobe Flash Player 13 NPAPI
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x000006a8
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
    		1 0 0
    Process injection Process 2952 called NtSetContextThread to modify thread in remote process 8232
    Time & API Arguments Status Return Repeated

    NtSetContextThread

    		 registers.eip: 2000355780
    registers.esp: 3931636
    registers.edi: 0
    registers.eax: 4289318
    registers.ebp: 0
    registers.edx: 0
    registers.ebx: 2130567168
    registers.esi: 0
    registers.ecx: 0
    thread_handle: 0x00000234
    process_identifier: 8232
    		1 0 0
    Process injection Process 2952 resumed a thread in remote process 8232
    Time & API Arguments Status Return Repeated

    NtResumeThread

    		 thread_handle: 0x00000234
    suspend_count: 1
    process_identifier: 8232
    		1 0 0
    Time & API Arguments Status Return Repeated

    NtResumeThread

    		 thread_handle: 0x000000dc
    suspend_count: 1
    process_identifier: 2952
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000014c
    suspend_count: 1
    process_identifier: 2952
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000001c4
    suspend_count: 1
    process_identifier: 2952
    		1 0 0

    CreateProcessInternalW

    		 thread_identifier: 8992
    thread_handle: 0x00000234
    process_identifier: 8232
    current_directory: C:\Users\test22\AppData\Local\Temp
    filepath:
    track: 1
    command_line: C:\Users\test22\AppData\Local\Temp\hBKKvc5PYJSJ.exe
    filepath_r:
    stack_pivoted: 0
    creation_flags: 134217740 (CREATE_NO_WINDOW|CREATE_SUSPENDED|DETACHED_PROCESS)
    inherit_handles: 0
    process_handle: 0x00000238
    		1 1 0

    NtUnmapViewOfSection

    		 base_address: 0x00400000
    region_size: 4521984
    process_identifier: 8232
    process_handle: 0x00000238
    		3221225497 0

    NtAllocateVirtualMemory

    		 process_identifier: 8232
    region_size: 114688
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00400000
    allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
    process_handle: 0x00000238
    		1 0 0

    NtGetContextThread

    		 thread_handle: 0x00000234
    		1 0 0

    NtSetContextThread

    		 registers.eip: 2000355780
    registers.esp: 3931636
    registers.edi: 0
    registers.eax: 4289318
    registers.ebp: 0
    registers.edx: 0
    registers.ebx: 2130567168
    registers.esi: 0
    registers.ecx: 0
    thread_handle: 0x00000234
    process_identifier: 8232
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000234
    suspend_count: 1
    process_identifier: 8232
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000000dc
    suspend_count: 1
    process_identifier: 8232
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000150
    suspend_count: 1
    process_identifier: 8232
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000190
    suspend_count: 1
    process_identifier: 8232
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000354
    suspend_count: 1
    process_identifier: 8232
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x00000668
    suspend_count: 1
    process_identifier: 8232
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000020c
    suspend_count: 1
    process_identifier: 8232
    		1 0 0

    NtGetContextThread

    		 thread_handle: 0x000000e4
    		1 0 0

    NtGetContextThread

    		 thread_handle: 0x000000e4
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x000000e4
    suspend_count: 1
    process_identifier: 8232
    		1 0 0
    MicroWorld-eScan Trojan.GenericKD.37043060
    FireEye Trojan.GenericKD.37043060
    McAfee Artemis!EA64FB745EF5
    Sangfor Infostealer.MSIL.Reline.gen
    K7AntiVirus Trojan ( 0057cf751 )
    BitDefender Trojan.GenericKD.37043060
    K7GW Trojan ( 0057cf751 )
    Symantec ML.Attribute.HighConfidence
    ESET-NOD32 a variant of MSIL/Kryptik.ABBS
    Avast Win32:CrypterX-gen [Trj]
    Kaspersky HEUR:Trojan-PSW.MSIL.Reline.gen
    Alibaba TrojanPSW:MSIL/Kryptik.6db5ec57
    Ad-Aware Trojan.GenericKD.37043060
    McAfee-GW-Edition Artemis!Trojan
    Emsisoft Trojan.GenericKD.37043060 (B)
    SentinelOne Static AI - Suspicious PE
    Avira TR/IPU.Minerva.ciszu
    Microsoft Trojan:Win32/AgentTesla!ml
    Gridinsoft Trojan.Win32.Kryptik.ns
    Arcabit Trojan.Generic.D2353B74
    GData MSIL.Trojan-Stealer.NetSteal.LLBTSD
    Cynet Malicious (score: 99)
    BitDefenderTheta Gen:NN.ZemsilF.34722.lm1@aG!T2cm
    MAX malware (ai score=99)
    Malwarebytes Spyware.RedLineStealer
    Panda Trj/GdSda.A
    TrendMicro-HouseCall TROJ_GEN.R06CH0AF421
    Ikarus Trojan.MSIL.Crypt
    Fortinet W32/Reline.ABBS!tr.pws
    Webroot W32.Malware.Gen
    AVG Win32:CrypterX-gen [Trj]
    Paloalto generic.ml