popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

edi.exe

AgentTesla Generic Malware info stealer browser Chrome Downloader Antivirus UPX Google User Data ScreenShot Create Service KeyLogger Socket Escalate priviledges Code injection Sniff Audio AntiDebug .NET EXE PNG Format PE File AntiVM MSOffice File PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 5, 2021, 5:38 p.m. Aug. 5, 2021, 5:40 p.m.
Size 594.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 6a1e010d4b1a7f82ebf0dd330155fe77
SHA256 ded1412f9509d9fbc0c48687c3611d6cd8356ff0f00a9a2c5836890a5df03925
CRC32 FABDD188
ssdeep 12288:byTwAFw8YWw+oIPFJnUUvNu9wGl87Dl3hUCwHpyZcmfvdEi/oGjYF7XyQLV8:ewAi6foIdJnUUvkwwkl3AHYZ3ndEco/5
Yara
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Name Response Post-Analysis Lookup
docs.microsoft.com
A 23.197.164.62
CNAME docs.microsoft.com-c.edgekey.net.globalredir.akadns.net
CNAME e13630.dscb.akamaiedge.net
CNAME docs.microsoft.com-c.edgekey.net
A 184.25.26.74
104.74.216.251
eter101.dvrlists.com
A 79.134.225.84
79.134.225.84
IP Address Status Action
104.74.214.213 Active Moloch
164.124.101.2 Active Moloch
184.25.26.74 Active Moloch
23.197.164.62 Active Moloch
79.134.225.84 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49216 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49218 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49217 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49221 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49219 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 184.25.26.74:443 -> 192.168.56.101:49220 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49242 -> 23.197.164.62:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49243 -> 23.197.164.62:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49264 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49244 -> 23.197.164.62:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49247 -> 23.197.164.62:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 23.197.164.62:443 -> 192.168.56.101:49246 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49263 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49245 -> 23.197.164.62:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49261 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49262 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49267 -> 184.25.26.74:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 184.25.26.74:443 -> 192.168.56.101:49265 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 104.74.214.213:80 -> 192.168.56.101:49260 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49232
79.134.225.84:2050 		None None None
TLS 1.3
192.168.56.101:49233
79.134.225.84:2050 		None None None
TLS 1.3
192.168.56.101:49234
79.134.225.84:2050 		None None None

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The term 'Set-MpPreference' is not recognized as the name of a cmdlet, function
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: , script file, or operable program. Check the spelling of the name, or if a pat
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: h was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:17
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Set-MpPreference <<<< -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Mi
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: crosoft\Windows\Start Menu\Programs\outlook.exe'
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Set-MpPreference:String) [], Co
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: mmandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510298
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510dd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510dd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510dd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510dd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510dd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510dd8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510218
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510ad8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510c18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510f58
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00510e98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
file C:\Program Files (x86)\Mozilla Firefox\nss3.dll
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e
0x216b5a5
0x216b51a
0x2168d7c
0x2168433
0x216023c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x3135ed @ 0x6ff535ed
0x6b1afd
0x6b0820
0x6b03fa
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215
system+0x1f6f75 @ 0x6e896f75
system+0x1ee251 @ 0x6e88e251
system+0x1ee229 @ 0x6e88e229
system+0x1ee170 @ 0x6e88e170
0x52a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
system+0x1ebc85 @ 0x6e88bc85
system+0x1f683b @ 0x6e89683b
system+0x1a5e44 @ 0x6e845e44
system+0x1fd8a0 @ 0x6e89d8a0
system+0x1fd792 @ 0x6e89d792
system+0x1a14bd @ 0x6e8414bd
0x6b00e3
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7575b479
registers.esp: 3269328
registers.edi: 1990713288
registers.eax: 16777216
registers.ebp: 3269532
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e
0x216b5a5
0x216b51a
0x2168d7c
0x2168433
0x216023c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x3135ed @ 0x6ff535ed
0x6b1afd
0x6b0820
0x6b03fa
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215
system+0x1f6f75 @ 0x6e896f75
system+0x1ee251 @ 0x6e88e251
system+0x1ee229 @ 0x6e88e229
system+0x1ee170 @ 0x6e88e170
0x52a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
system+0x1ebc85 @ 0x6e88bc85
system+0x1f683b @ 0x6e89683b
system+0x1a5e44 @ 0x6e845e44
system+0x1fd8a0 @ 0x6e89d8a0
system+0x1fd792 @ 0x6e89d792
system+0x1a14bd @ 0x6e8414bd
0x6b00e3
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7575b479
registers.esp: 3269328
registers.edi: 1990713288
registers.eax: 4194304
registers.ebp: 3269532
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e
0x216b5a5
0x216b51a
0x2168d7c
0x2168433
0x216023c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x3135ed @ 0x6ff535ed
0x6b1afd
0x6b0820
0x6b03fa
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215
system+0x1f6f75 @ 0x6e896f75
system+0x1ee251 @ 0x6e88e251
system+0x1ee229 @ 0x6e88e229
system+0x1ee170 @ 0x6e88e170
0x52a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
system+0x1ebc85 @ 0x6e88bc85
system+0x1f683b @ 0x6e89683b
system+0x1a5e44 @ 0x6e845e44
system+0x1fd8a0 @ 0x6e89d8a0
system+0x1fd792 @ 0x6e89d792
system+0x1a14bd @ 0x6e8414bd
0x6b00e3
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7575b479
registers.esp: 3269328
registers.edi: 1990713288
registers.eax: 12910592
registers.ebp: 3269532
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x7575b37e
0x216b5a5
0x216b51a
0x2168d7c
0x2168433
0x216023c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737
mscorlib+0x2d36ad @ 0x6ff136ad
mscorlib+0x308f2d @ 0x6ff48f2d
mscorlib+0x3135ed @ 0x6ff535ed
0x6b1afd
0x6b0820
0x6b03fa
system+0x1f9799 @ 0x6e899799
system+0x1f92c8 @ 0x6e8992c8
system+0x1eca74 @ 0x6e88ca74
system+0x1ec868 @ 0x6e88c868
system+0x1f82b8 @ 0x6e8982b8
system+0x1ee54d @ 0x6e88e54d
system+0x1f70ea @ 0x6e8970ea
system+0x1e56c0 @ 0x6e8856c0
system+0x1f8215 @ 0x6e898215
system+0x1f6f75 @ 0x6e896f75
system+0x1ee251 @ 0x6e88e251
system+0x1ee229 @ 0x6e88e229
system+0x1ee170 @ 0x6e88e170
0x52a08e
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x755b6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x755b6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
system+0x1ebc85 @ 0x6e88bc85
system+0x1f683b @ 0x6e89683b
system+0x1a5e44 @ 0x6e845e44
system+0x1fd8a0 @ 0x6e89d8a0
system+0x1fd792 @ 0x6e89d792
system+0x1a14bd @ 0x6e8414bd
0x6b00e3
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72752e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72807610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72891dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10
exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479
exception.instruction: mov dword ptr [ecx + edx*4], eax
exception.module: KERNEL32.dll
exception.exception_code: 0xc0000005
exception.offset: 242809
exception.address: 0x7575b479
registers.esp: 3269328
registers.edi: 1990713288
registers.eax: 14548992
registers.ebp: 3269532
registers.edx: 0
registers.ebx: 0
registers.esi: 1
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a
SHGetDataFromIDListW+0x314 SHGetFolderPathAndSubDirW-0x2832 shell32+0x328ef @ 0x758628ef
ShellExecuteExW+0x5e1 SHGetNameFromIDList-0x8629 shell32+0x22427 @ 0x75852427
SHGetMalloc+0x17e0 ShellExecuteExW-0x64 shell32+0x21de2 @ 0x75851de2
ShellExecuteExW+0xb4 SHGetNameFromIDList-0x8b56 shell32+0x21efa @ 0x75851efa
ShellExecuteExW+0x42 SHGetNameFromIDList-0x8bc8 shell32+0x21e88 @ 0x75851e88
New_shell32_ShellExecuteExW@4+0x1fa New_srvcli_NetShareEnum@28-0x8f @ 0x73cc5f28
ShellExecuteW+0x77 PathResolve-0x6af shell32+0x13ce8 @ 0x75843ce8
LockClrVersion+0x14ac CorBindToRuntimeByPath-0x1c83 mscoreei+0x1c2ae @ 0x6e80c2ae
LockClrVersion+0x685 CorBindToRuntimeByPath-0x2aaa mscoreei+0x1b487 @ 0x6e80b487
LockClrVersion+0x2b5a CorBindToRuntimeByPath-0x5d5 mscoreei+0x1d95c @ 0x6e80d95c
ND_WU1+0xc2f _CorExeMain-0x5ac mscoreei+0xef86 @ 0x6e7fef86
ND_WU1+0xded _CorExeMain-0x3ee mscoreei+0xf144 @ 0x6e7ff144
ND_WU1+0x109c _CorExeMain-0x13f mscoreei+0xf3f3 @ 0x6e7ff3f3
ND_WU1+0x1166 _CorExeMain-0x75 mscoreei+0xf4bd @ 0x6e7ff4bd
_CorExeMain+0x54 GetFileVersion-0x2957 mscoreei+0xf586 @ 0x6e7ff586
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x6f687f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x6f684de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x72083c8c
registers.esp: 777868
registers.edi: 0
registers.eax: 1913142412
registers.ebp: 777908
registers.edx: 0
registers.ebx: 0
registers.esi: 1913142412
registers.ecx: 8719720
1 0 0
request GET http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00570000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00600000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020f0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00555000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0055b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00537000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72142000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00536000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02290000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02291000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02292000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0213f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02130000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x09160000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 57344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x09161000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0916f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02160000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02161000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02162000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02164000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02165000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02166000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02131000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02167000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02168000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02169000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0216a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0216b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0216c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 812
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72142000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1032
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1032
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description edi.exe tried to sleep 288 seconds, actually delayed analysis time by 288 seconds
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera\wand.dat
file C:\Users\test22\AppData\Roaming\Opera\Opera7\profile\wand.dat
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Temp\_Bbmzsbjgqtrphzjybyx.vbs
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0
cmdline powershell Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
cmdline C:\Windows\SysWOW64\svchost.exe
file C:\Users\test22\AppData\Local\Temp\_Bbmzsbjgqtrphzjybyx.vbs
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000130
process_name: pw.exe
process_identifier: 604
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: taskhost.exe
process_identifier: 1568
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: edi.exe
process_identifier: 2316
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: iexplore.exe
process_identifier: 2908
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: iexplore.exe
process_identifier: 1744
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: iexplore.exe
process_identifier: 2088
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: svchost.exe
process_identifier: 2764
1 1 0

Process32NextW

 snapshot_handle: 0x00000130
process_name: edi.exe
process_identifier: 2564
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x067a0000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00084200', u'virtual_address': u'0x00002000', u'entropy': 7.997455074300602, u'name': u'.text', u'virtual_size': u'0x00084114'} entropy 7.9974550743 description A section with a high entropy has been found
section {u'size_of_data': u'0x00010200', u'virtual_address': u'0x00088000', u'entropy': 7.136329948441091, u'name': u'.rsrc', u'virtual_size': u'0x0001016c'} entropy 7.13632994844 description A section with a high entropy has been found
entropy 0.999157540017 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Communications over RAW Socket rule Network_TCP_Socket
description Create a windows service rule Create_Service
description Record Audio rule Sniff_Audio
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description Escalate priviledges rule Escalate_priviledges
description Run a KeyLogger rule KeyLogger
description Win.Trojan.agentTesla rule Win_Trojan_agentTesla_Zero
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description browser info stealer rule infoStealer_browser_Zero
description File Downloader rule Network_Downloader
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian
2 0
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2908 CREDAT:79875
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2908 CREDAT:145409
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
host 104.74.214.213
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2316
region_size: 495616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000280
1 0 0

NtAllocateVirtualMemory

 process_identifier: 540
region_size: 638976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000100
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 638976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000110
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 638976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2564
region_size: 491520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000022c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2180
region_size: 147456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000022c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3036
region_size: 356352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000022c
1 0 0
file C:\Users\test22\AppData\Roaming\Digsby\digsby.dat
file C:\Users\test22\AppData\Roaming\MySpace\IM\users.txt
registry HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords
registry HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
registry HKEY_CURRENT_USER\Software\Paltalk
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªƒB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,c皨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,c皿cûâ,cîâ-cñã,cy¼%b±â,c|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà  l÷0@€‡ÜÔKPˆ80l8Älhl@0t.text¶ `.rdataˆo0p@@.data\= Ž@À.tls àœ@À.gfids0ðž@@.rsrcÔKL¢@@.relocˆ8P:î@B
base_address: 0x00400000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    ´tE¸wE²tE..€¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F„¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶Fˆ¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢Fˆ¡F8zE¸{EŠEè¡F€§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ€§Fþÿÿÿþÿÿÿu˜0Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ46E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@
base_address: 0x0046a000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x0046e000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: +ÔÔ„?¤Ø¾Ø„? Ù„?)s„?ÚuZ55g;Ù.~~Dñìð„?„?m(À'Æؒخ’õŒЈûõÛÝÛÝÛ(jk¡iæÞ\šF“£ã¥w¡Ô(´öä¼éÙ  b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x0046f000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 540
process_handle: 0x00000100
1 1 0

WriteProcessMemory

 buffer: ` 1
base_address: 0x0049a000
process_identifier: 540
process_handle: 0x00000100
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 540
process_handle: 0x00000100
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 2572
process_handle: 0x00000110
1 1 0

WriteProcessMemory

 buffer: ` 1
base_address: 0x0049a000
process_identifier: 2572
process_handle: 0x00000110
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2572
process_handle: 0x00000110
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 2764
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer: ` 1
base_address: 0x0049a000
process_identifier: 2764
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2764
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer: MZ@ÿÿ¸ º´ Í!¸LÍ!Win32 .EXE. $@PEL´Ë^à Ðètbà@€!f `tpð`X.MPRESS1Pöàà.MPRESS2Þ `øàà.rsrcp@Àv2.19
base_address: 0x00400000
process_identifier: 2564
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: ð`|að`ü`‰aü`ašaa a§a aaÄaaaäaa$a÷a$a,a b,a4a&b4a<aAb<aDa[bDaXaka”a€³aÐaïabb3bMbebGetModuleHandleAGetProcAddressKERNEL32.DLLmsvcrt.dllabsCOMCTL32.dllVERSION.dllVerQueryValueWWININET.dllFindCloseUrlCacheUSER32.dllGetDCGDI32.dllSetBkModecomdlg32.dllFindTextWADVAPI32.dllRegCloseKeySHELL32.dllSHGetMallocole32.dllCoInitialize`èXZ ‹0ð+À‹þf­Áà ‹ÈP­+Èñ‹ÈWQIŠD9ˆ1uö+À¬‹È€áð$Áá Šè¬ ÈQͽýÿÿÓåYX‹Ü¤lñÿÿQ+ÉQQ‹ÌQf‹Áâ RWƒÁQPƒÁVQè^‹ã^Z+À‰2´+Ð+É;Ês&‹Ù¬A$þ<èuòCƒÁ­ Àx;ÂsåëÃxßÂ+ÉFüëÖè_ÇMÿÿÿ°éª¸V «èX˜ éˆ UWVSƒì|‹”$ÇD$tÆD$s‹¬$œB‰D$x¸¶J‹ØÓã‹ËI‰L$l¶JÓàH‰D$h‹„$¨¶2ÇEÇD$`Ǹ‰t$dÇD$\ÇD$XÇD$TÇD$P¶JÎÓàˆ69L$ts‹D$xfǃÀâö‹œ$”3ÿÇD$Hÿÿÿÿ‹Ó”$˜‰T$L3Ò;\$L„} ¶ÁçBC øƒú~狌$¤9L$tƒe ‹t$t#t$l‹D$`‹T$xÁà‰t$DƁ|$Hÿÿÿ,Bw;\$L„- Ád$H¶ÁçC ø‹D$Hf‹UÁè ·Ê¯Á;øƒÝ‰D$H¸+ÁŠL$dÁø¾¶T$sf‰E‹D$t#D$h‹l$xÓà¹+L$dÓúÂiÀƒ|$`„(l‰D$ŽÊ‹D$t+D$\‹”$ ¶‰D$@Ñd$@‹L$@6‹l$á|$HÿÿÿDM‰L$<,w;\$L„aÁd$H¶ÁçC ø‹D$Hf‹Áè ·ñ¯Æ;øs#‰D$H¸+ƋòÁøƒ|$<f‰…t"ë.)D$H+ø‹ÁrfÁèf+ȃ|$<f‰tþÿŽWÿÿÿëyþÿq6‹l$ê|$Hÿÿÿw;\$L„ÅÁd$H¶ÁçC ø‹D$Hf‹MÁè ·ñ¯Æ;øs‰D$H¸+ƋòÁøf‰EëŸ)D$H+ø‹ÁrfÁèf+Èf‰M뇋T$t‹Æ‹Œ$ ˆD$sˆBƒ|$`‰T$t ÇD$`éƒ|$`  ƒl$`é ƒl$`é‹L$H+ø‹t$`+ȋÂfÁèf+Ёùÿÿÿf‰U‹l$xtu‰t$8w;\$L„ò¶ÁçÁáC ø‹l$8‹ÁÁè f‹•€·ê¯Å;øsR‹ð¸+ŋl$XÁø‹L$T‹T$8‰L$P‹L$xf‰‚€‹D$\‰l$T‰D$X3Àƒ|$`ŸÀÁd@‰D$`ét‹ñ+ø+ð‹ÂfÁè‹L$8f+Ёþÿÿÿf‰‘€w;\$L„N¶ÁçÁæC ø‹l$8‹ÖÁê f‹˜·Á¯Ð;úƒã½‹ò+èÇD$4‹ÅÁø‹L$8f‰˜‹D$`‹L$DÁàD$xúÿÿÿ,Hw;\$L„ܶÁçÁæC øf‹•à‹ÆÁè ·Ê¯Á;øs`)L$4Á|$4‹t$4‰D$Hƒ|$tf‰…à„”3Àƒ|$`‹¬$ ‹T$tŸÀD ‰D$`‹D$t+D$\Š(ˆD$sˆDB‰T$té2+ð+ø‹ÂfÁèf+Ðf‰•àé‹Á+òfÁè‹l$8f+È+úþÿÿÿf‰˜w;\$L„¶ÁçÁæC ø‹L$8‹ÆÁè f‹‘°·Ê¯Á;øs#‹ð¸+Á‹l$8Áøf‰…°‹D$X頋Î+ø+ȋÂfÁèf+ЋD$8ùÿÿÿf‰°w;\$L„¢¶ÁçÁáC ø‹t$8‹ÁÁè f‹–È·ê¯Å;øs ‹ð¸+ŋl$8Áøf‰…È‹D$Të&‹ñ+ø+ð‹ÂfÁèf+ЋD$8f‰È‹T$T‹D$P‰T$P‹L$X‰L$T‹l$\‰D$\‰l$X3Àƒ|$`‹L$xŸÀÁh D@‰D$`þÿÿÿw;\$L„ô¶ÁçÁæC øf‹‹ÆÁè ·ê¯Å;øs/‰D$H¸+ÅÁd$DÁøÇD$,f‰‹D$DL‰L$ër+ð+ø‹ÂfÁèf+Ёþÿÿÿf‰w;\$L„…¶ÁçÁæC øf‹Q‹ÆÁè ·ê¯Å;øs;‰D$H¸+ÅÁd$DÁøÇD$,‹T$Df‰AŒ ‰L$ÇD$0ë/+ð+ø‹Â‰t$HfÁèÇD$,f+ÐÇD$0f‰QÁ‰L$‹L$0º‰L$(,‹t$õ|$Hÿÿÿw;\$L„ÒÁd$H¶ÁçC ø‹D$Hf‹Áè ·Ê¯Á;øs‰D$H¸+ÁÁø‹Õf‰ë)D$H+ø‹ÂfÁèf+Ðf‰U‹t$(N‰t$(u‰ŠL$0¸Óà+ÐT$,ƒ|$`‰T$ çƒD$`ƒú‹Â~¸‹t$xÁàÇD$$„0`‰D$¸,‹t$õ|$Hÿÿÿw;\$L„ Ád$H¶ÁçC ø‹D$Hf‹Áè ·Ê¯Á;øs‰D$H¸+ÁÁøf‰‹Åë)D$H+ø‹ÂfÁèf+ЍEf‰‹l$$M‰l$$u‰PÀƒú‰$Ž'‹Â‹òÑøƒæHÿƒÎƒú ‰L$ ‹l$xÓæ҉4$Du+Â^‰D$ëVPû|$Hÿÿÿw;\$L„WÁd$H¶ÁçC øÑl$Hö;|$Hr+|$HƒÎJuȋD$xÁæ‰4$DÇD$ ‰D$ÇD$¸‹l$À‰D$è|$Hÿÿÿw;\$L„ëÁd$H¶ÁçC ø‹D$Hf‹UÁè ·ò¯Æ;øs‰D$H¸+ÆÁøf‰E‹D$ë)D$H+ø‹ÂfÁèf+ЋD$f‰U‹T$@ $‹L$ Ñd$I‰L$ …pÿÿÿ‹4$F‰t$\tZ‹L$ ‹l$tƒÁ9l$\w`‹„$ ‹Õ+D$\”$ tŠFˆD$sˆBÿD$tIt‹¬$¤9l$trâë‹„$¤9D$t‚ºöÿÿ|$Hÿÿÿw;\$L¸t)ë¸ë C+œ$”3À‹”$œ‹L$t‰‹œ$¨‰ ƒÄ|[^_]Ãéä þÿ,¢øÿMs
base_address: 0x00476000
process_identifier: 2564
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: (€0€p€`€BIN2H€ ` 2@ä Ѐ ø€# €&H€'p€/˜€0À€?è€@€R8€ èàH4ä KVä 8lLXä `ÄLöä ˆ¼MÚä °˜NDä ØÜN ä üOºä (¸Pbä PQhäx€  r|ä|4VS_VERSION_INFO½ïþ?ÚStringFileInfo¶040904b00CompanyNameNirSoft`FileDescriptionWeb Browser Password Viewer*FileVersion2.06LInternalNameWeb Browser Pass Viewh"LegalCopyrightCopyright © 2011 - 2020 Nir Sofer.ProductVersion2.06DVarFileInfo$Translation °
base_address: 0x00477000
process_identifier: 2564
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2564
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: MZ@ÿÿ¸ º´ Í!¸LÍ!Win32 .EXE. $@PEL»üiTà 2¶"P@@÷  0È H.MPRESS1Öàà.MPRESS2p Øàà.rsrc0æ@Àv2.19
base_address: 0x00400000
process_identifier: 2180
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: È D!È Ô Q!Ô Ü b!Ü ä o!ä ì ‚!ì ô ˜!ô ü ¸!ü !Ó!! !í! ! !3!\!€z!Œ!¥!Å!ß!÷!GetModuleHandleAGetProcAddressKERNEL32.DLLmsvcrt.dllabsCOMCTL32.dllUSER32.dllGetDCGDI32.dllSetBkModecomdlg32.dllGetSaveFileNameAADVAPI32.dllRegEnumKeyASHELL32.dllSHGetMallocole32.dllCoInitialize`èXZ ‹0ð+À‹þf­Áà ‹ÈP­+Èñ‹ÈWQIŠD9ˆ1uö+À¬‹È€áð$Áá Šè¬ ÈQͽýÿÿÓåYX‹Ü¤lñÿÿQ+ÉQQ‹ÌQf‹Áâ RWƒÁQPƒÁVQè^‹ã^Z+À‰2´+Ð+É;Ês&‹Ù¬A$þ<èuòCƒÁ­ Àx;ÂsåëÃxßÂ+ÉFüëÖè_ÇMÿÿÿ°éª¸V «èX˜ éˆ UWVSƒì|‹”$ÇD$tÆD$s‹¬$œB‰D$x¸¶J‹ØÓã‹ËI‰L$l¶JÓàH‰D$h‹„$¨¶2ÇEÇD$`Ǹ‰t$dÇD$\ÇD$XÇD$TÇD$P¶JÎÓàˆ69L$ts‹D$xfǃÀâö‹œ$”3ÿÇD$Hÿÿÿÿ‹Ó”$˜‰T$L3Ò;\$L„} ¶ÁçBC øƒú~狌$¤9L$tƒe ‹t$t#t$l‹D$`‹T$xÁà‰t$DƁ|$Hÿÿÿ,Bw;\$L„- Ád$H¶ÁçC ø‹D$Hf‹UÁè ·Ê¯Á;øƒÝ‰D$H¸+ÁŠL$dÁø¾¶T$sf‰E‹D$t#D$h‹l$xÓà¹+L$dÓúÂiÀƒ|$`„(l‰D$ŽÊ‹D$t+D$\‹”$ ¶‰D$@Ñd$@‹L$@6‹l$á|$HÿÿÿDM‰L$<,w;\$L„aÁd$H¶ÁçC ø‹D$Hf‹Áè ·ñ¯Æ;øs#‰D$H¸+ƋòÁøƒ|$<f‰…t"ë.)D$H+ø‹ÁrfÁèf+ȃ|$<f‰tþÿŽWÿÿÿëyþÿq6‹l$ê|$Hÿÿÿw;\$L„ÅÁd$H¶ÁçC ø‹D$Hf‹MÁè ·ñ¯Æ;øs‰D$H¸+ƋòÁøf‰EëŸ)D$H+ø‹ÁrfÁèf+Èf‰M뇋T$t‹Æ‹Œ$ ˆD$sˆBƒ|$`‰T$t ÇD$`éƒ|$`  ƒl$`é ƒl$`é‹L$H+ø‹t$`+ȋÂfÁèf+Ёùÿÿÿf‰U‹l$xtu‰t$8w;\$L„ò¶ÁçÁáC ø‹l$8‹ÁÁè f‹•€·ê¯Å;øsR‹ð¸+ŋl$XÁø‹L$T‹T$8‰L$P‹L$xf‰‚€‹D$\‰l$T‰D$X3Àƒ|$`ŸÀÁd@‰D$`ét‹ñ+ø+ð‹ÂfÁè‹L$8f+Ёþÿÿÿf‰‘€w;\$L„N¶ÁçÁæC ø‹l$8‹ÖÁê f‹˜·Á¯Ð;úƒã½‹ò+èÇD$4‹ÅÁø‹L$8f‰˜‹D$`‹L$DÁàD$xúÿÿÿ,Hw;\$L„ܶÁçÁæC øf‹•à‹ÆÁè ·Ê¯Á;øs`)L$4Á|$4‹t$4‰D$Hƒ|$tf‰…à„”3Àƒ|$`‹¬$ ‹T$tŸÀD ‰D$`‹D$t+D$\Š(ˆD$sˆDB‰T$té2+ð+ø‹ÂfÁèf+Ðf‰•àé‹Á+òfÁè‹l$8f+È+úþÿÿÿf‰˜w;\$L„¶ÁçÁæC ø‹L$8‹ÆÁè f‹‘°·Ê¯Á;øs#‹ð¸+Á‹l$8Áøf‰…°‹D$X頋Î+ø+ȋÂfÁèf+ЋD$8ùÿÿÿf‰°w;\$L„¢¶ÁçÁáC ø‹t$8‹ÁÁè f‹–È·ê¯Å;øs ‹ð¸+ŋl$8Áøf‰…È‹D$Të&‹ñ+ø+ð‹ÂfÁèf+ЋD$8f‰È‹T$T‹D$P‰T$P‹L$X‰L$T‹l$\‰D$\‰l$X3Àƒ|$`‹L$xŸÀÁh D@‰D$`þÿÿÿw;\$L„ô¶ÁçÁæC øf‹‹ÆÁè ·ê¯Å;øs/‰D$H¸+ÅÁd$DÁøÇD$,f‰‹D$DL‰L$ër+ð+ø‹ÂfÁèf+Ёþÿÿÿf‰w;\$L„…¶ÁçÁæC øf‹Q‹ÆÁè ·ê¯Å;øs;‰D$H¸+ÅÁd$DÁøÇD$,‹T$Df‰AŒ ‰L$ÇD$0ë/+ð+ø‹Â‰t$HfÁèÇD$,f+ÐÇD$0f‰QÁ‰L$‹L$0º‰L$(,‹t$õ|$Hÿÿÿw;\$L„ÒÁd$H¶ÁçC ø‹D$Hf‹Áè ·Ê¯Á;øs‰D$H¸+ÁÁø‹Õf‰ë)D$H+ø‹ÂfÁèf+Ðf‰U‹t$(N‰t$(u‰ŠL$0¸Óà+ÐT$,ƒ|$`‰T$ çƒD$`ƒú‹Â~¸‹t$xÁàÇD$$„0`‰D$¸,‹t$õ|$Hÿÿÿw;\$L„ Ád$H¶ÁçC ø‹D$Hf‹Áè ·Ê¯Á;øs‰D$H¸+ÁÁøf‰‹Åë)D$H+ø‹ÂfÁèf+ЍEf‰‹l$$M‰l$$u‰PÀƒú‰$Ž'‹Â‹òÑøƒæHÿƒÎƒú ‰L$ ‹l$xÓæ҉4$Du+Â^‰D$ëVPû|$Hÿÿÿw;\$L„WÁd$H¶ÁçC øÑl$Hö;|$Hr+|$HƒÎJuȋD$xÁæ‰4$DÇD$ ‰D$ÇD$¸‹l$À‰D$è|$Hÿÿÿw;\$L„ëÁd$H¶ÁçC ø‹D$Hf‹UÁè ·ò¯Æ;øs‰D$H¸+ÆÁøf‰E‹D$ë)D$H+ø‹ÂfÁèf+ЋD$f‰U‹T$@ $‹L$ Ñd$I‰L$ …pÿÿÿ‹4$F‰t$\tZ‹L$ ‹l$tƒÁ9l$\w`‹„$ ‹Õ+D$\”$ tŠFˆD$sˆBÿD$tIt‹¬$¤9l$trâë‹„$¤9D$t‚ºöÿÿ|$Hÿÿÿw;\$L¸t)ë¸ë C+œ$”3À‹”$œ‹L$t‰‹œ$¨‰ ƒÄ|[^_]Ãé ÿÿšâýÿMs
base_address: 0x00422000
process_identifier: 2180
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2180
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: MZ@ÿÿ¸ º´ Í!¸LÍ!Win32 .EXE. $@PEL›;à]à :â8RP@p#ù P8`ÜPP.MPRESS1@´àà.MPRESS2¢ P¶àà.rsrc`Ä@Àv2.19
base_address: 0x00400000
process_identifier: 3036
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: ÜP`QÜPèPmQèPðP~QðPøP‹QøPQ¨QQQ»QQQÑQQQêQQ QR Q(QR(Q<QOQxQ€–Q³QÅQÞQ÷QR)RGetModuleHandleAGetProcAddressKERNEL32.DLLmsvcrt.dlllogCOMCTL32.dllRPCRT4.dllUuidFromStringAUSER32.dllGetDCGDI32.dllSetBkModecomdlg32.dllFindTextAADVAPI32.dllRegEnumKeyASHELL32.dllSHGetMallocole32.dllCoInitialize`èXZ ‹0ð+À‹þf­Áà ‹ÈP­+Èñ‹ÈWQIŠD9ˆ1uö+À¬‹È€áð$Áá Šè¬ ÈQͽýÿÿÓåYX‹Ü¤lñÿÿQ+ÉQQ‹ÌQf‹Áâ RWƒÁQPƒÁVQè^‹ã^Z+À‰2´+Ð+É;Ês&‹Ù¬A$þ<èuòCƒÁ­ Àx;ÂsåëÃxßÂ+ÉFüëÖè_ÇMÿÿÿ°éª¸V «èX˜ éˆ UWVSƒì|‹”$ÇD$tÆD$s‹¬$œB‰D$x¸¶J‹ØÓã‹ËI‰L$l¶JÓàH‰D$h‹„$¨¶2ÇEÇD$`Ǹ‰t$dÇD$\ÇD$XÇD$TÇD$P¶JÎÓàˆ69L$ts‹D$xfǃÀâö‹œ$”3ÿÇD$Hÿÿÿÿ‹Ó”$˜‰T$L3Ò;\$L„} ¶ÁçBC øƒú~狌$¤9L$tƒe ‹t$t#t$l‹D$`‹T$xÁà‰t$DƁ|$Hÿÿÿ,Bw;\$L„- Ád$H¶ÁçC ø‹D$Hf‹UÁè ·Ê¯Á;øƒÝ‰D$H¸+ÁŠL$dÁø¾¶T$sf‰E‹D$t#D$h‹l$xÓà¹+L$dÓúÂiÀƒ|$`„(l‰D$ŽÊ‹D$t+D$\‹”$ ¶‰D$@Ñd$@‹L$@6‹l$á|$HÿÿÿDM‰L$<,w;\$L„aÁd$H¶ÁçC ø‹D$Hf‹Áè ·ñ¯Æ;øs#‰D$H¸+ƋòÁøƒ|$<f‰…t"ë.)D$H+ø‹ÁrfÁèf+ȃ|$<f‰tþÿŽWÿÿÿëyþÿq6‹l$ê|$Hÿÿÿw;\$L„ÅÁd$H¶ÁçC ø‹D$Hf‹MÁè ·ñ¯Æ;øs‰D$H¸+ƋòÁøf‰EëŸ)D$H+ø‹ÁrfÁèf+Èf‰M뇋T$t‹Æ‹Œ$ ˆD$sˆBƒ|$`‰T$t ÇD$`éƒ|$`  ƒl$`é ƒl$`é‹L$H+ø‹t$`+ȋÂfÁèf+Ёùÿÿÿf‰U‹l$xtu‰t$8w;\$L„ò¶ÁçÁáC ø‹l$8‹ÁÁè f‹•€·ê¯Å;øsR‹ð¸+ŋl$XÁø‹L$T‹T$8‰L$P‹L$xf‰‚€‹D$\‰l$T‰D$X3Àƒ|$`ŸÀÁd@‰D$`ét‹ñ+ø+ð‹ÂfÁè‹L$8f+Ёþÿÿÿf‰‘€w;\$L„N¶ÁçÁæC ø‹l$8‹ÖÁê f‹˜·Á¯Ð;úƒã½‹ò+èÇD$4‹ÅÁø‹L$8f‰˜‹D$`‹L$DÁàD$xúÿÿÿ,Hw;\$L„ܶÁçÁæC øf‹•à‹ÆÁè ·Ê¯Á;øs`)L$4Á|$4‹t$4‰D$Hƒ|$tf‰…à„”3Àƒ|$`‹¬$ ‹T$tŸÀD ‰D$`‹D$t+D$\Š(ˆD$sˆDB‰T$té2+ð+ø‹ÂfÁèf+Ðf‰•àé‹Á+òfÁè‹l$8f+È+úþÿÿÿf‰˜w;\$L„¶ÁçÁæC ø‹L$8‹ÆÁè f‹‘°·Ê¯Á;øs#‹ð¸+Á‹l$8Áøf‰…°‹D$X頋Î+ø+ȋÂfÁèf+ЋD$8ùÿÿÿf‰°w;\$L„¢¶ÁçÁáC ø‹t$8‹ÁÁè f‹–È·ê¯Å;øs ‹ð¸+ŋl$8Áøf‰…È‹D$Të&‹ñ+ø+ð‹ÂfÁèf+ЋD$8f‰È‹T$T‹D$P‰T$P‹L$X‰L$T‹l$\‰D$\‰l$X3Àƒ|$`‹L$xŸÀÁh D@‰D$`þÿÿÿw;\$L„ô¶ÁçÁæC øf‹‹ÆÁè ·ê¯Å;øs/‰D$H¸+ÅÁd$DÁøÇD$,f‰‹D$DL‰L$ër+ð+ø‹ÂfÁèf+Ёþÿÿÿf‰w;\$L„…¶ÁçÁæC øf‹Q‹ÆÁè ·ê¯Å;øs;‰D$H¸+ÅÁd$DÁøÇD$,‹T$Df‰AŒ ‰L$ÇD$0ë/+ð+ø‹Â‰t$HfÁèÇD$,f+ÐÇD$0f‰QÁ‰L$‹L$0º‰L$(,‹t$õ|$Hÿÿÿw;\$L„ÒÁd$H¶ÁçC ø‹D$Hf‹Áè ·Ê¯Á;øs‰D$H¸+ÁÁø‹Õf‰ë)D$H+ø‹ÂfÁèf+Ðf‰U‹t$(N‰t$(u‰ŠL$0¸Óà+ÐT$,ƒ|$`‰T$ çƒD$`ƒú‹Â~¸‹t$xÁàÇD$$„0`‰D$¸,‹t$õ|$Hÿÿÿw;\$L„ Ád$H¶ÁçC ø‹D$Hf‹Áè ·Ê¯Á;øs‰D$H¸+ÁÁøf‰‹Åë)D$H+ø‹ÂfÁèf+ЍEf‰‹l$$M‰l$$u‰PÀƒú‰$Ž'‹Â‹òÑøƒæHÿƒÎƒú ‰L$ ‹l$xÓæ҉4$Du+Â^‰D$ëVPû|$Hÿÿÿw;\$L„WÁd$H¶ÁçC øÑl$Hö;|$Hr+|$HƒÎJuȋD$xÁæ‰4$DÇD$ ‰D$ÇD$¸‹l$À‰D$è|$Hÿÿÿw;\$L„ëÁd$H¶ÁçC ø‹D$Hf‹UÁè ·ò¯Æ;øs‰D$H¸+ÆÁøf‰E‹D$ë)D$H+ø‹ÂfÁèf+ЋD$f‰U‹T$@ $‹L$ Ñd$I‰L$ …pÿÿÿ‹4$F‰t$\tZ‹L$ ‹l$tƒÁ9l$\w`‹„$ ‹Õ+D$\”$ tŠFˆD$sˆBÿD$tIt‹¬$¤9l$trâë‹„$¤9D$t‚ºöÿÿ|$Hÿÿÿw;\$L¸t)ë¸ë C+œ$”3À‹”$œ‹L$t‰‹œ$¨‰ ƒÄ|[^_]Ãé5ìþÿh²úÿMs
base_address: 0x00455000
process_identifier: 3036
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 3036
process_handle: 0x0000022c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªƒB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,c皨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,c皿cûâ,cîâ-cñã,cy¼%b±â,c|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà  l÷0@€‡ÜÔKPˆ80l8Älhl@0t.text¶ `.rdataˆo0p@@.data\= Ž@À.tls àœ@À.gfids0ðž@@.rsrcÔKL¢@@.relocˆ8P:î@B
base_address: 0x00400000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 540
process_handle: 0x00000100
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 2572
process_handle: 0x00000110
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 2764
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer: MZ@ÿÿ¸ º´ Í!¸LÍ!Win32 .EXE. $@PEL´Ë^à Ðètbà@€!f `tpð`X.MPRESS1Pöàà.MPRESS2Þ `øàà.rsrcp@Àv2.19
base_address: 0x00400000
process_identifier: 2564
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: MZ@ÿÿ¸ º´ Í!¸LÍ!Win32 .EXE. $@PEL»üiTà 2¶"P@@÷  0È H.MPRESS1Öàà.MPRESS2p Øàà.rsrc0æ@Àv2.19
base_address: 0x00400000
process_identifier: 2180
process_handle: 0x0000022c
1 1 0

WriteProcessMemory

 buffer: MZ@ÿÿ¸ º´ Í!¸LÍ!Win32 .EXE. $@PEL›;à]à :â8RP@p#ù P8`ÜPP.MPRESS1@´àà.MPRESS2¢ P¶àà.rsrc`Ä@Àv2.19
base_address: 0x00400000
process_identifier: 3036
process_handle: 0x0000022c
1 1 0
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x004088ca
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 9896771 0
Cylance Unsafe
CrowdStrike win/malicious_confidence_80% (W)
APEX Malicious
MaxSecure Trojan.Malware.300983.susgen
FireEye Generic.mg.6a1e010d4b1a7f82
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
Malwarebytes MachineLearning/Anomalous.96%
eGambit Unsafe.AI_Score_99%
Cybereason malicious.d87b82
registry HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
registry HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
registry HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
registry HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Process injection Process 2216 called NtSetContextThread to modify thread in remote process 2316
Process injection Process 2316 called NtSetContextThread to modify thread in remote process 540
Process injection Process 2316 called NtSetContextThread to modify thread in remote process 2572
Process injection Process 2316 called NtSetContextThread to modify thread in remote process 2764
Process injection Process 2316 called NtSetContextThread to modify thread in remote process 2564
Process injection Process 2316 called NtSetContextThread to modify thread in remote process 2180
Process injection Process 2316 called NtSetContextThread to modify thread in remote process 3036
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4388716
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000003e8
process_identifier: 2316
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1572168
registers.edi: 0
registers.eax: 4743438
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000fc
process_identifier: 540
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1374820
registers.edi: 0
registers.eax: 4743438
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000104
process_identifier: 2572
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 785900
registers.edi: 0
registers.eax: 4743438
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000011c
process_identifier: 2764
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 3538744
registers.edi: 0
registers.eax: 4678260
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2564
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 3275448
registers.edi: 0
registers.eax: 4334086
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2180
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1441636
registers.edi: 0
registers.eax: 4543032
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 3036
1 0 0
parent_process wscript.exe martian_process powershell Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
Process injection Process 2216 resumed a thread in remote process 2316
Process injection Process 2316 resumed a thread in remote process 540
Process injection Process 2316 resumed a thread in remote process 2572
Process injection Process 2316 resumed a thread in remote process 2764
Process injection Process 2316 resumed a thread in remote process 2564
Process injection Process 2316 resumed a thread in remote process 2180
Process injection Process 2316 resumed a thread in remote process 3036
Process injection Process 2908 resumed a thread in remote process 1744
Process injection Process 2908 resumed a thread in remote process 2088
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000003e8
suspend_count: 1
process_identifier: 2316
1 0 0

NtResumeThread

 thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 540
1 0 0

NtResumeThread

 thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x0000011c
suspend_count: 1
process_identifier: 2764
1 0 0

NtResumeThread

 thread_handle: 0x00000220
suspend_count: 1
process_identifier: 2564
1 0 0

NtResumeThread

 thread_handle: 0x00000220
suspend_count: 1
process_identifier: 2180
1 0 0

NtResumeThread

 thread_handle: 0x00000220
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x0000033c
suspend_count: 1
process_identifier: 1744
1 0 0

NtResumeThread

 thread_handle: 0x00000554
suspend_count: 1
process_identifier: 2088
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2216
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 2216
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2216
1 0 0

CreateProcessInternalW

 thread_identifier: 808
thread_handle: 0x000003e4
process_identifier: 812
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\wscript.exe
track: 1
command_line: "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\_Bbmzsbjgqtrphzjybyx.vbs"
filepath_r: C:\Windows\System32\WScript.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003d8
1 1 0

CreateProcessInternalW

 thread_identifier: 1240
thread_handle: 0x000003e8
process_identifier: 2316
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\edi.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000280
1 1 0

NtGetContextThread

 thread_handle: 0x000003e8
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2316
region_size: 495616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000280
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªƒB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,c皨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,c皿cûâ,cîâ-cñã,cy¼%b±â,c|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà  l÷0@€‡ÜÔKPˆ80l8Älhl@0t.text¶ `.rdataˆo0p@@.data\= Ž@À.tls àœ@À.gfids0ðž@@.rsrcÔKL¢@@.relocˆ8P:î@B
base_address: 0x00400000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00453000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: €ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ “    ´tE¸wE²tE..€¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F„¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶Fˆ¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢Fˆ¡F8zE¸{EŠEè¡F€§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ€§Fþÿÿÿþÿÿÿu˜0Ï!­tåša¾Œe¸‘¢z»Œ^ž âȨ3œ46E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@
base_address: 0x0046a000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: €
base_address: 0x0046e000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: +ÔÔ„?¤Ø¾Ø„? Ù„?)s„?ÚuZ55g;Ù.~~Dñìð„?„?m(À'Æؒخ’õŒЈûõÛÝÛÝÛ(jk¡iæÞ\šF“£ã¥w¡Ô(´öä¼éÙ  b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` Ÿž†…¢†…§µ¶³´±²¯°†…¸ Ÿ†… Y
base_address: 0x0046f000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00470000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00475000
process_identifier: 2316
process_handle: 0x00000280
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2316
process_handle: 0x00000280
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4388716
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000003e8
process_identifier: 2316
1 0 0

NtResumeThread

 thread_handle: 0x000003e8
suspend_count: 1
process_identifier: 2316
1 0 0

CreateProcessInternalW

 thread_identifier: 2416
thread_handle: 0x000002e8
process_identifier: 1032
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\outlook.exe'
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002f0
1 1 0

CreateProcessInternalW

 thread_identifier: 1224
thread_handle: 0x000000fc
process_identifier: 540
current_directory:
filepath:
track: 1
command_line: C:\Windows\SysWOW64\svchost.exe
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000100
1 1 0

NtGetContextThread

 thread_handle: 0x000000fc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 540
region_size: 638976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000100
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 540
process_handle: 0x00000100
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 540
process_handle: 0x00000100
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00488000
process_identifier: 540
process_handle: 0x00000100
1 1 0

WriteProcessMemory

 buffer: ` 1
base_address: 0x0049a000
process_identifier: 540
process_handle: 0x00000100
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 540
process_handle: 0x00000100
1 1 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1572168
registers.edi: 0
registers.eax: 4743438
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000fc
process_identifier: 540
1 0 0

NtResumeThread

 thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 540
1 0 0

CreateProcessInternalW

 thread_identifier: 2704
thread_handle: 0x00000104
process_identifier: 2572
current_directory:
filepath:
track: 1
command_line: C:\Windows\SysWOW64\svchost.exe
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000110
1 1 0

NtGetContextThread

 thread_handle: 0x00000104
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 638976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000110
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 2572
process_handle: 0x00000110
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2572
process_handle: 0x00000110
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00488000
process_identifier: 2572
process_handle: 0x00000110
1 1 0

WriteProcessMemory

 buffer: ` 1
base_address: 0x0049a000
process_identifier: 2572
process_handle: 0x00000110
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2572
process_handle: 0x00000110
1 1 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1374820
registers.edi: 0
registers.eax: 4743438
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000104
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2572
1 0 0

CreateProcessInternalW

 thread_identifier: 2480
thread_handle: 0x0000011c
process_identifier: 2764
current_directory:
filepath:
track: 1
command_line: C:\Windows\SysWOW64\svchost.exe
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000228
1 1 0

NtGetContextThread

 thread_handle: 0x0000011c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2764
region_size: 638976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELŽ~±Æà 0Ba €@ À @…¼`O€l   `  H.textA B `.rsrcl€D@@.reloc   F @B
base_address: 0x00400000
process_identifier: 2764
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2764
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00488000
process_identifier: 2764
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer: ` 1
base_address: 0x0049a000
process_identifier: 2764
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2764
process_handle: 0x00000228
1 1 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 785900
registers.edi: 0
registers.eax: 4743438
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000011c
process_identifier: 2764
1 0 0

NtResumeThread

 thread_handle: 0x0000011c
suspend_count: 1
process_identifier: 2764
1 0 0

CreateProcessInternalW

 thread_identifier: 2620
thread_handle: 0x00000220
process_identifier: 2564
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\edi.exe /stext "C:\Users\test22\AppData\Local\Temp\ozdweyveusxkjlmjfnuehefwbqbf"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000022c
1 1 0
file C:\Windows\SysWOW64\wscript.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe