Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 23, 2021, 8:22 a.m.	Sept. 23, 2021, 8:29 a.m.

Size	73.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ecb887b80ecdd78f0d5c3d93e77fe21c`
SHA256	`4d88199ada7b791bc7f1d03faa7ecb85b7a5f42ecedc3f84a9514afd4f5996c4`
CRC32	`F60F08A6`
ssdeep	`1536:57wy8P6KV6w1DbzQVOcfjyCKoyfBB5JLezr+J:57wyTKV6w5sjbyCKoyj5szSJ`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description)

DownFlSetup999.exe "C:\Users\test22\AppData\Local\Temp\DownFlSetup999.exe"
2020
- 2001651.scr "C:\Users\test22\AppData\Roaming\2001651.scr" /S
  2428
- 5022517.scr "C:\Users\test22\AppData\Roaming\5022517.scr" /S
  1516
- 7466362.scr "C:\Users\test22\AppData\Roaming\7466362.scr" /S
  2620
- 3942601.scr "C:\Users\test22\AppData\Roaming\3942601.scr" /S
  1080

Name	Response	Post-Analysis Lookup
iplogger.org	A 88.99.66.31	88.99.66.31
guidereviews.bar	A 172.67.202.60 A 104.21.22.36	172.67.202.60
api.ip.sb	CNAME api.ip.sb.cdn.cloudflare.net A 104.26.13.31 A 104.26.12.31 A 172.67.75.172	104.26.13.31
all-design-space.top	A 104.21.74.160 A 172.67.159.221	104.21.74.160

IP Address	Status	Action
104.21.22.36	Active	Moloch
104.21.74.160	Active	Moloch
104.26.13.31	Active	Moloch
164.124.101.2	Active	Moloch
188.124.36.242	Active	Moloch
188.165.222.221	Active	Moloch
88.99.66.31	Active	Moloch
94.140.112.88	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49164 -> 104.21.22.36:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.102:64995 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.102:49170 -> 104.21.74.160:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49173 -> 104.26.13.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49177 -> 104.26.13.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49189 -> 104.26.13.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49188 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49187 -> 88.99.66.31:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49164 104.21.22.36:443	C=US, O=Let's Encrypt, CN=R3	CN=*.guidereviews.bar	f8:d2:01:79:14:17:35:10:a6:4c:62:52:e6:c8:6d:5a:41:fd:04:99
TLSv1 192.168.56.102:49170 104.21.74.160:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	25:5b:bb:c9:8a:6c:8d:6c:d1:1c:b3:8c:2c:4e:76:b3:e4:a9:95:c3
TLSv1 192.168.56.102:49173 104.26.13.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLSv1 192.168.56.102:49177 104.26.13.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLSv1 192.168.56.102:49189 104.26.13.31:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	7d:9f:08:6e:96:fc:4c:1d:eb:94:53:45:8a:6c:7e:e7:c1:69:47:e9
TLSv1 192.168.56.102:49188 88.99.66.31:443	None	None	None
TLSv1 192.168.56.102:49187 88.99.66.31:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.iplogger.org	55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb

Queries for the computername (40 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 23, 2021, 8:24 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (10 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 23, 2021, 8:15 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:15 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:23 a.m.			0	0
IsDebuggerPresent Sept. 23, 2021, 8:23 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (30 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052a658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052a658 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052a3d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0097d9c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0097d9c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0097da08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a1f218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a1f218 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a1f118 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a1f498 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a1f558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a1f558 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00784408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00784408 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00784448 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06862938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06862938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06862838 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06862c78 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06862cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06862cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006661f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x067b7300 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x067b7300 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x067b7200 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x067b7580 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x067b7640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 23, 2021, 8:24 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x067b7640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 23, 2021, 8:15 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	\x018\x00=!39d
section

One or more processes crashed (50 out of 51 events)

Time & API	Arguments	Status
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xb4e5f3 0xb4e548 0xb4d87d 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648220 registers.edi: 41732004 registers.eax: 0 registers.ebp: 4648280 registers.edx: 11877420 registers.ebx: 41731808 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xb4e5f3 0xb4e548 0xb4d87d 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648220 registers.edi: 43264436 registers.eax: 0 registers.ebp: 4648280 registers.edx: 11877420 registers.ebx: 43264240 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xb4e5f3 0xb4e548 0xb4d87d 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648220 registers.edi: 44620520 registers.eax: 0 registers.ebp: 4648280 registers.edx: 11877420 registers.ebx: 44620324 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x106547c 0x10653d8 0xb4d914 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648212 registers.edi: 41463888 registers.eax: 0 registers.ebp: 4648272 registers.edx: 11877420 registers.ebx: 41463692 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x106547c 0x10653d8 0xb4d914 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648212 registers.edi: 42802804 registers.eax: 0 registers.ebp: 4648272 registers.edx: 11877420 registers.ebx: 42802608 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x106547c 0x10653d8 0xb4d914 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648212 registers.edi: 44129880 registers.eax: 0 registers.ebp: 4648272 registers.edx: 11877420 registers.ebx: 44129684 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x10659d5 0x1065918 0xb4da7f 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 45457060 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 45456864 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x10659d5 0x1065918 0xb4da7f 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 47245136 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 47244940 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x10659d5 0x1065918 0xb4da7f 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 42208148 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 42207952 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x1065e0e 0x1065d68 0xb4db16 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 43625728 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 43625532 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x1065e0e 0x1065d68 0xb4db16 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 45045712 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 45045516 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x1065e0e 0x1065d68 0xb4db16 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 41645144 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 41644948 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xb4e5f3 0xb4e548 0xb4d87d 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648220 registers.edi: 43082444 registers.eax: 0 registers.ebp: 4648280 registers.edx: 11877420 registers.ebx: 43082248 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xb4e5f3 0xb4e548 0xb4d87d 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648220 registers.edi: 44437576 registers.eax: 0 registers.ebp: 4648280 registers.edx: 11877420 registers.ebx: 44437380 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xb4e5f3 0xb4e548 0xb4d87d 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648220 registers.edi: 45792720 registers.eax: 0 registers.ebp: 4648280 registers.edx: 11877420 registers.ebx: 45792524 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x106547c 0x10653d8 0xb4d914 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648212 registers.edi: 47495712 registers.eax: 0 registers.ebp: 4648272 registers.edx: 11877420 registers.ebx: 47495516 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x106547c 0x10653d8 0xb4d914 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648212 registers.edi: 42397508 registers.eax: 0 registers.ebp: 4648272 registers.edx: 11877420 registers.ebx: 42397312 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x106547c 0x10653d8 0xb4d914 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648212 registers.edi: 43724596 registers.eax: 0 registers.ebp: 4648272 registers.edx: 11877420 registers.ebx: 43724400 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x10659d5 0x1065918 0xb4da7f 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 45051728 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 45051532 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x10659d5 0x1065918 0xb4da7f 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 41931468 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 41931272 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x10659d5 0x1065918 0xb4da7f 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 43360808 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 43360612 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x1065e0e 0x1065d68 0xb4db16 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 44778364 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 44778168 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x1065e0e 0x1065d68 0xb4db16 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 46198336 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 46198140 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x1065e0e 0x1065d68 0xb4db16 0xb4b69c 0xb49797 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 40 04 89 45 d0 0f b6 45 d8 85 c0 0f 84 cc 01 exception.instruction: mov eax, dword ptr [eax + 4] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb4e983 registers.esp: 4648224 registers.edi: 42968848 registers.eax: 0 registers.ebp: 4648284 registers.edx: 11877420 registers.ebx: 42968652 registers.esi: 228426098 registers.ecx: 11882968	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae2362 0xb49835 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 39 09 e8 88 dc 9e 71 85 c0 0f 8e 1d 02 00 00 b9 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae2c11 registers.esp: 4648576 registers.edi: 41184560 registers.eax: 41989376 registers.ebp: 4648740 registers.edx: 0 registers.ebx: 41172052 registers.esi: 2040787737 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43295736 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43324280 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43295804 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43325404 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43295856 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43325404 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b cb e8 e8 82 a0 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b77 registers.esp: 4648644 registers.edi: 43295896 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43327064 registers.esi: 1326156677 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43295964 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43327768 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43296100 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43329936 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43296124 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43329936 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43296152 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43329936 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43296184 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43329936 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43296212 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43329936 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43296392 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43334540 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b cb e8 e8 82 a0 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b77 registers.esp: 4648644 registers.edi: 43296476 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43337420 registers.esi: 1326156677 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43296556 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43338068 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0xae327a 0xae314d 0xb49877 0xb496e8 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7410f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74397f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74394de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d8 b8 16 a7 75 59 35 93 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xae6b2a registers.esp: 4648644 registers.edi: 43323788 registers.eax: 0 registers.ebp: 4648700 registers.edx: 5453552 registers.ebx: 43409116 registers.esi: 3 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 5022517+0x34097e @ 0x57097e 5022517+0x332676 @ 0x562676 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 46 09 c2 8a 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 11664924 registers.edi: 2506752 registers.eax: 11664924 registers.ebp: 11665004 registers.edx: 2130566132 registers.ebx: 1968701414 registers.esi: 2008380459 registers.ecx: 2343567360	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: exception.instruction_r: ed e9 86 4c 02 00 81 46 e6 cd 39 04 92 0a 00 00 exception.symbol: 5022517+0x35d2d1 exception.instruction: in eax, dx exception.module: 5022517.scr exception.exception_code: 0xc0000096 exception.offset: 3527377 exception.address: 0x58d2d1 registers.esp: 11665044 registers.edi: 4199455 registers.eax: 1750617430 registers.ebp: 2506752 registers.edx: 22614 registers.ebx: 2147483650 registers.esi: 3078356 registers.ecx: 20	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: exception.instruction_r: ed e9 89 bd 0a 00 c3 e9 fd 50 0b 00 ff d0 9c 53 exception.symbol: 5022517+0x2c127a exception.instruction: in eax, dx exception.module: 5022517.scr exception.exception_code: 0xc0000096 exception.offset: 2888314 exception.address: 0x4f127a registers.esp: 11665044 registers.edi: 4199455 registers.eax: 1447909480 registers.ebp: 2506752 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 3078356 registers.ecx: 10	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x2b7a7fd 0x2b7a74e 0x2b75e97 0x2b75bd1 0x2b74a24 0x2b70076 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b12e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bc74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bc7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c51dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c51e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c51f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c5416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74367f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74364de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2b7a891 registers.esp: 11661872 registers.edi: 51361136 registers.eax: 0 registers.ebp: 11661896 registers.edx: 9793656 registers.ebx: 51360420 registers.esi: 51361240 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 7466362+0x306a88 @ 0x15f6a88 7466362+0x32b3ef @ 0x161b3ef exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 6a ad da 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 4192020 registers.edi: 20070400 registers.eax: 4192020 registers.ebp: 4192100 registers.edx: 2130566132 registers.ebx: 32 registers.esi: 2008380459 registers.ecx: 3496083456	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: exception.instruction_r: ed e9 03 6b 0d 00 a1 00 a6 f9 00 00 04 00 00 00 exception.symbol: 7466362+0x2dde85 exception.instruction: in eax, dx exception.module: 7466362.scr exception.exception_code: 0xc0000096 exception.offset: 3006085 exception.address: 0x15cde85 registers.esp: 4192140 registers.edi: 21869464 registers.eax: 1750617430 registers.ebp: 20070400 registers.edx: 22614 registers.ebx: 2147483650 registers.esi: 20675855 registers.ecx: 20	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: exception.instruction_r: ed e9 4b 0c ff ff c3 e9 11 eb f8 ff 97 07 ad 22 exception.symbol: 7466362+0x3af7b2 exception.instruction: in eax, dx exception.module: 7466362.scr exception.exception_code: 0xc0000096 exception.offset: 3864498 exception.address: 0x169f7b2 registers.esp: 4192140 registers.edi: 21869464 registers.eax: 1447909480 registers.ebp: 20070400 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 20675855 registers.ecx: 10	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 0x6172e5 0x617236 0x6161f7 0x615f31 0x614d84 0x610076 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72b02652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x72b1264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x72b12e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x72bc74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72bc7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x72c51dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72c51e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72c51f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x72c5416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74367f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74364de3 exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x617379 registers.esp: 4188976 registers.edi: 53464360 registers.eax: 0 registers.ebp: 4189000 registers.edx: 7694528 registers.ebx: 53463644 registers.esi: 53464464 registers.ecx: 0	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: 3942601+0x360f8e @ 0x1260f8e 3942601+0x3364a7 @ 0x12364a7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 c1 da 96 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 2030984 registers.edi: 15941632 registers.eax: 2030984 registers.ebp: 2031064 registers.edx: 2130566132 registers.ebx: 1968701414 registers.esi: 2008380459 registers.ecx: 4085645312	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: exception.instruction_r: ed e9 a4 73 fd ff 38 19 a6 73 c4 1f 5e b2 44 e1 exception.symbol: 3942601+0x37d9ee exception.instruction: in eax, dx exception.module: 3942601.scr exception.exception_code: 0xc0000096 exception.offset: 3660270 exception.address: 0x127d9ee registers.esp: 2031104 registers.edi: 17943017 registers.eax: 1750617430 registers.ebp: 15941632 registers.edx: 22614 registers.ebx: 2147483650 registers.esi: 16748691 registers.ecx: 20	1
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: exception.instruction_r: ed e9 10 86 fe ff c3 e9 ce 36 02 00 a9 a2 ea 05 exception.symbol: 3942601+0x3786fb exception.instruction: in eax, dx exception.module: 3942601.scr exception.exception_code: 0xc0000096 exception.offset: 3639035 exception.address: 0x12786fb registers.esp: 2031104 registers.edi: 17943017 registers.eax: 1447909480 registers.ebp: 15941632 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 16748691 registers.ecx: 10	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (8 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET https://guidereviews.bar/?username=p9_1
suspicious_features	GET method with no useragent header	suspicious_request	GET https://guidereviews.bar/?username=p9_2
suspicious_features	GET method with no useragent header	suspicious_request	GET https://guidereviews.bar/?username=p9_3
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST https://all-design-space.top/
suspicious_features	GET method with no useragent header	suspicious_request	GET https://api.ip.sb/geoip
suspicious_features	GET method with no useragent header	suspicious_request	GET https://guidereviews.bar/?username=p9_4
suspicious_features	GET method with no useragent header	suspicious_request	GET https://guidereviews.bar/?username=p9_7
suspicious_features	GET method with no useragent header	suspicious_request	GET https://iplogger.org/1aNhd7

Performs some HTTP requests (9 events)

request	GET https://guidereviews.bar/?username=p9_1
request	GET https://guidereviews.bar/?username=p9_2
request	GET https://guidereviews.bar/?username=p9_3
request	POST https://all-design-space.top/
request	GET https://api.ip.sb/geoip
request	GET https://guidereviews.bar/?username=p9_4
request	GET https://guidereviews.bar/?username=p9_7
request	GET https://iplogger.org/1aBhd7
request	GET https://iplogger.org/1aNhd7

Sends data using the HTTP POST Method (1 event)

request

POST https://all-design-space.top/

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

all-design-space.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 959 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000690000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1a3b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000bb0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef13a4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e92000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e98000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e98000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e98000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 23, 2021, 8:15 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e98000 process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (9 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Nichrome\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Roaming\7466362.scr
file	C:\Users\test22\AppData\Roaming\2001651.scr
file	C:\Users\test22\AppData\Roaming\5022517.scr
file	C:\Users\test22\AppData\Roaming\3942601.scr

Drops a binary and executes it (4 events)

file	C:\Users\test22\AppData\Roaming\2001651.scr
file	C:\Users\test22\AppData\Roaming\5022517.scr
file	C:\Users\test22\AppData\Roaming\7466362.scr
file	C:\Users\test22\AppData\Roaming\3942601.scr

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Roaming\7466362.scr
file	C:\Users\test22\AppData\Roaming\2001651.scr
file	C:\Users\test22\AppData\Roaming\5022517.scr
file	C:\Users\test22\AppData\Roaming\3942601.scr

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 23, 2021, 8:16 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\2001651.scr parameters: filepath: C:\Users\test22\AppData\Roaming\2001651.scr	1	1
ShellExecuteExW Sept. 23, 2021, 8:16 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\5022517.scr parameters: filepath: C:\Users\test22\AppData\Roaming\5022517.scr	1	1
ShellExecuteExW Sept. 23, 2021, 8:16 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\7466362.scr parameters: filepath: C:\Users\test22\AppData\Roaming\7466362.scr	1	1
ShellExecuteExW Sept. 23, 2021, 8:16 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Roaming\3942601.scr parameters: filepath: C:\Users\test22\AppData\Roaming\3942601.scr	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 23, 2021, 8:15 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00005200', u'virtual_address': u'0x00002000', u'entropy': 7.991449044735362, u'name': u'\\x018\\x00=!39d', u'virtual_size': u'0x00005178'}

entropy

7.99144904474

description

A section with a high entropy has been found

entropy

0.28275862069

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (5 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 23, 2021, 8:16 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 23, 2021, 8:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 23, 2021, 8:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 23, 2021, 8:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 23, 2021, 8:24 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Expresses interest in specific running processes (1 event)

process

system

Queries for potentially installed applications (50 out of 212 events)

Time & API	Arguments	Status
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000330 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: 7-Zip base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: AddressBook base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: Adobe AIR base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: Connection Manager base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: DirectDrawEx base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: EditPlus base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: ePageSafer base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: Fontcore base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: Google Chrome base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: Haansoft HWord 80 Korean base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: IE40 base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: IE4Data base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: IE5BAKEX base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: IEData base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: MobileOptionPack base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: Office14.PROPLUS base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: SchedulingAgent base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: TouchEn nxKey base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: UnINISafeWeb base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: UnINISafeWeb6 base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: WIC base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1 base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {1F1C2DFC-2D24-3E06-BCB8-725134ADF989} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1 base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {8941A397-4065-4F41-92CE-0EB610846EED}_is1 base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-0011-0000-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-0015-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-0016-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-0018-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-0019-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-001A-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-001B-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-001F-0409-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-001F-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-0028-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-002C-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-0044-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-006E-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-00A1-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {90140000-00BA-0412-0000-0000000FF1CE} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExW Sept. 23, 2021, 8:23 a.m.	regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x00000330 key_handle: 0x0000033c options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1

Terminates another process (1 event)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 23, 2021, 8:16 a.m.	status_code: 0xffffffff process_identifier: 2020 process_handle: 0x0000000000000264		0	0

Communicates with host for which no DNS query was performed (3 events)

host	188.124.36.242
host	188.165.222.221
host	94.140.112.88

Checks for the presence of known windows from debuggers and forensic tools (50 out of 134 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 23, 2021, 8:23 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 23, 2021, 8:23 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Collects information about installed applications (50 out of 160 events)

Time & API	Arguments	Status
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 6.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb6\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Delfino G3 (x86) version 3.6.6.5 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1CBD185A-9CB3-4f30-B7E4-75CC551455F9}_is1\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: G2BRUN regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFEB79-2B4D-4EEE-9979-AFDE0A20FADE}_is1\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: WIZVERA Process Manager 1,0,5,4 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8941A397-4065-4F41-92CE-0EB610846EED}_is1\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (Korean) 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x0000033c regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: MarkAny Inc. e-PageSafer V2.5 NoAX ( Basic )_2.5.1.18 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ePageSafer\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 한컴오피스 한글 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: TouchEn nxKey with E2E for 32bit regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TouchEn nxKey\DisplayName	1
RegQueryValueExW Sept. 23, 2021, 8:23 a.m.	key_handle: 0x00000228 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: INISafeWeb 5.0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UnINISafeWeb\DisplayName	1

Harvests credentials from local email clients (2 events)

file	C:\Users\test22\AppData\Local\Thunderbird\Profiles\hzkyl8yo.default
file	C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\hzkyl8yo.default

Deletes a large number of files from the system indicative of ransomware, wiper malware or system destruction (50 out of 123 events)

file	C:\Users\test22\AppData\Local\Temp\tmpF596.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF777.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF6B7.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF6EC.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF6DB.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF71F.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF754.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF650.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF5E8.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF5FA.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF60B.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF673.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF61D.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF62E.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF44C.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF6C9.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF661.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF742.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF731.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF70E.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF766.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF789.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF5D6.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF6A6.tmp
file	C:\Users\test22\AppData\Local\Temp\tmpF694.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp430E.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42D5.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42C4.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp4330.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42D7.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42FB.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp428E.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp430F.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp430C.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42C5.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp427B.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp4331.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42A0.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42FC.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42D6.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42E9.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp430D.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42EA.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp427C.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42A2.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp429F.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42B2.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42B3.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42A1.tmp
file	C:\Users\test22\AppData\Local\Temp\tmp42D8.tmp

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 23, 2021, 8:23 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 23, 2021, 8:23 a.m.	stacktrace: exception.instruction_r: ed e9 89 bd 0a 00 c3 e9 fd 50 0b 00 ff d0 9c 53 exception.symbol: 5022517+0x2c127a exception.instruction: in eax, dx exception.module: 5022517.scr exception.exception_code: 0xc0000096 exception.offset: 2888314 exception.address: 0x4f127a registers.esp: 11665044 registers.edi: 4199455 registers.eax: 1447909480 registers.ebp: 2506752 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 3078356 registers.ecx: 10	1	0	0

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Lionic	Trojan.Win32.Bulz.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.744158
FireEye	Generic.mg.ecb887b80ecdd78f
ALYac	Gen:Variant.Bulz.744158
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.55c949
BitDefenderTheta	Gen:NN.ZemsilF.34170.eu0@aCowjj
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent_AGen.L
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan-PSW.MSIL.Reline.gen
BitDefender	Gen:Variant.Bulz.744158
Avast	FileRepMalware
Ad-Aware	Gen:Variant.Bulz.744158
Emsisoft	Gen:Variant.Bulz.744158 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.lh
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Infostealer.Redline
MAX	malware (ai score=87)
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
Gridinsoft	Trojan.Heur!.03011281
Microsoft	TrojanSpy:MSIL/Redline.STA
GData	Win32.Trojan.Ilgergop.808OIX
VBA32	CIL.StupidPInvoker-1.Heur
TrendMicro-HouseCall	HackTool.MSIL.REDLINE.USMANIM21
Fortinet	PossibleThreat
AVG	FileRepMalware
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)

DownFlSetup999.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All