popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.exe

NPKI Emotet Generic Malware Malicious Library Downloader UPX Malicious Packer FTP DGA HTTP Escalate priviledges Create Service KeyLogger Code injection Sniff Audio P2P Internet API DNS ScreenShot Socket PWS
  1. Resubmit sample
    Category Machine Started Completed
    FILE s1_win7_x6403_us Jan. 16, 2022, 10:14 p.m. Jan. 16, 2022, 10:28 p.m.
    Size 2.3MB
    Type PE32+ executable (GUI) x86-64, for MS Windows
    MD5 ad95832fa72da070fe465948cdf54f40
    SHA256 dac434ec87d2d83b5426f13247201e8d8826133fc445a4468f4fdc49b19eea2c
    CRC32 8D1B1F57
    ssdeep 49152:nZb84h8ohujx7Tf4bN/OPHW6Fxiz8lVHTIioOFZQ+:Zb8FF1f4bN/OPH5FxiqZ7
    Yara
    • TESTYARA - (no description)
    • IsPE64 - (no description)
    • PE_Header_Zero - PE File Signature
    • Malicious_Library_Zero - Malicious_Library
    • UPX_Zero - UPX packed file

    Name Response Post-Analysis Lookup
    No hosts contacted.
    IP Address Status Action
    46.3.197.102 Active Moloch

    Suricata Alerts

    No Suricata Alerts

    Suricata TLS

    No Suricata TLS

    Time & API Arguments Status Return Repeated

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0

    GetComputerNameW

    		 computer_name: TEST22-PC
    		1 1 0
    Time & API Arguments Status Return Repeated

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0

    IsDebuggerPresent

    		 0 0
    Time & API Arguments Status Return Repeated

    WriteConsoleW

    		 buffer: C:\Users\test22\AppData\Local\Temp\ready>
    console_handle: 0x0000000000000007
    		1 1 0

    WriteConsoleW

    		 buffer: cls
    console_handle: 0x0000000000000007
    		1 1 0

    WriteConsoleW

    		 buffer: '■' is not recognized as an internal or external command, operable program or batch file.
    console_handle: 0x000000000000000b
    		1 1 0

    WriteConsoleW

    		 buffer: 1 file(s) moved.
    console_handle: 0x0000000000000007
    		1 1 0

    WriteConsoleW

    		 buffer: Launched 'tea.exe'.
    console_handle: 0x0000000000000007
    		1 1 0

    WriteConsoleW

    		 buffer: Press any key to continue . . .
    console_handle: 0x0000000000000007
    		1 1 0
    Time & API Arguments Status Return Repeated

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d48d8
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d48d8
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d4958
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d4a58
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d4a98
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d4a98
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d50d8
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d50d8
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0

    CryptExportKey

    		 buffer: <INVALID POINTER>
    crypto_handle: 0x003d4f98
    flags: 0
    crypto_export_handle: 0x00000000
    blob_type: 6
    		1 1 0
    file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
    Time & API Arguments Status Return Repeated

    GlobalMemoryStatusEx

    		 1 1 0
    Time & API Arguments Status Return Repeated

    __exception__

    		 stacktrace: 
    0xa35d02
0xa35c7d
0xa3147c
0xa311d0
0xa30056
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7395264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73952e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73a074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73a07610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73a91dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73a91e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73a91f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73a9416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73fef5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74277f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74274de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

    exception.instruction_r: 8b 01 8b 40 28 ff 10 8b d0 85 c0 75 06 8b 15 2c
    exception.instruction: mov eax, dword ptr [ecx]
    exception.exception_code: 0xc0000005
    exception.symbol:
    exception.address: 0xa35d91
    registers.esp: 2354460
    registers.edi: 40435124
    registers.eax: 0
    registers.ebp: 2354484
    registers.edx: 3829288
    registers.ebx: 38675324
    registers.esi: 40435304
    registers.ecx: 0
    		1 0 0

    __exception__

    		 stacktrace: 
    CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x73af1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x739c2ba1
mscorlib+0x36dd51 @ 0x7233dd51
mscorlib+0x32fea6 @ 0x722ffea6
mscorlib+0x30ab40 @ 0x722dab40
0xa3c649
0xa3c55a
0xa3ed25
0xa3e9ea
0xa3b0da
0xa35e99
0xa314e6
0xa311d0
0xa30056
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7395264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73952e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73a074ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73a07610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x73a91dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x73a91e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x73a91f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x73a9416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x73fef5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74277f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74274de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x772e9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x772e9ea5

    exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
    exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
    exception.instruction: leave
    exception.module: KERNELBASE.dll
    exception.exception_code: 0xe0434f4e
    exception.offset: 46887
    exception.address: 0x766fb727
    registers.esp: 2353904
    registers.edi: 0
    registers.eax: 2353904
    registers.ebp: 2353984
    registers.edx: 0
    registers.ebx: 3940600
    registers.esi: 3829288
    registers.ecx: 3812082458
    		1 0 0
    Time & API Arguments Status Return Repeated

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 458752
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x006e0000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00710000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 2956
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x73941000
    process_handle: 0xffffffff
    		1 0 0

    NtProtectVirtualMemory

    		 process_identifier: 2956
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    length: 4096
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x73942000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 1900544
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x020f0000
    allocation_type: 8192 (MEM_RESERVE)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x02280000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00512000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00585000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0058b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00587000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0052c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a30000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0051a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00576000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0057a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00577000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0057b000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0052a000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0057c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0051c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 327680
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef58000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 65536
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef40000
    allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef40000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef50000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef58000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x7ef40000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0057d000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00578000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x020ff000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x020f0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x020f1000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a31000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a32000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0057e000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0058c000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0052d000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x0057f000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a33000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a34000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a35000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x020f2000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x020f3000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a36000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a37000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a38000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00579000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2956
    region_size: 4096
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00a39000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0
    Time & API Arguments Status Return Repeated

    GetDiskFreeSpaceExW

    		 total_number_of_free_bytes: 0
    free_bytes_available: 10232291328
    root_path: C:\Users\test22\AppData\Local\Temp\ready
    total_number_of_bytes: 0
    		1 1 0
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
    file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
    file C:\Users\test22\AppData\Local\Temp\ready\extracted\tea.exe
    file C:\Users\test22\AppData\Local\Temp\ready\7z.dll
    file C:\Users\test22\AppData\Local\Temp\ready\7z.exe
    file C:\Users\test22\AppData\Local\Temp\ready\svchost.cmd
    cmdline "C:\Users\test22\AppData\Local\Temp\ready\svchost.cmd" /S
    cmdline svchost.cmd /S
    Time & API Arguments Status Return Repeated

    ShellExecuteExW

    		 show_type: 0
    filepath_r: svchost.cmd
    parameters: /S
    filepath: svchost.cmd
    		1 1 0
    Time & API Arguments Status Return Repeated

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeRestorePrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeRestorePrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeRestorePrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeRestorePrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeRestorePrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeRestorePrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeSecurityPrivilege
    		1 1 0

    LookupPrivilegeValueW

    		 system_name:
    privilege_name: SeDebugPrivilege
    		1 1 0
    description Create a windows service rule Create_Service
    description Communication using DGA rule Network_DGA
    description Communications over RAW Socket rule Network_TCP_Socket
    description Communications use DNS rule Network_DNS
    description Match Windows Inet API call rule Str_Win32_Internet_API
    description Code injection with CreateRemoteThread in a remote process rule Code_injection
    description Record Audio rule Sniff_Audio
    description Communications over HTTP rule Network_HTTP
    description Run a KeyLogger rule KeyLogger
    description Communications over FTP rule Network_FTP
    description Escalate priviledges rule Escalate_priviledges
    description File Downloader rule Network_Downloader
    description RedLine stealer rule RedLine_Stealer_m_Zero
    description Take ScreenShot rule ScreenShot
    description Communications over P2P network rule Network_P2P_Win
    description (no description) rule DebuggerCheck__GlobalFlags
    description (no description) rule DebuggerCheck__QueryInfo
    description (no description) rule DebuggerCheck__RemoteAPI
    description (no description) rule DebuggerHiding__Thread
    description (no description) rule DebuggerHiding__Active
    description (no description) rule DebuggerException__ConsoleCtrl
    description (no description) rule DebuggerException__SetConsoleCtrl
    description (no description) rule ThreadControl__Context
    description (no description) rule SEH__vectored
    description (no description) rule Check_Dlls
    description Checks if being debugged rule anti_dbg
    description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
    description Bypass DEP rule disable_dep
    description Affect hook table rule win_hook
    description Install itself for autorun at Windows startup rule Persistence
    description Steal credential rule local_credential_Steal
    description Match Windows Http API call rule Str_Win32_Http_API
    Time & API Arguments Status Return Repeated

    RegOpenKeyExW

    		 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    base_handle: 0x80000002
    key_handle: 0x00000368
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: 7-Zip
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: AddressBook
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Adobe AIR
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Connection Manager
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: DirectDrawEx
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: EditPlus
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Fontcore
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Google Chrome
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Haansoft HWord 80 Korean
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: IE40
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: IE4Data
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: IE5BAKEX
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: IEData
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: MobileOptionPack
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko)
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: Office15.PROPLUSR
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: SchedulingAgent
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: WIC
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {4A03706F-666A-4037-7777-5F2748764D10}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-0015-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-0016-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-0018-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-0019-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-001A-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-001B-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-001F-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-001F-040C-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-002C-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-0044-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-006E-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-0090-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-00A1-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-00BA-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-00E1-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-00E2-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-0115-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-0117-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {90150000-012B-0409-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {91150000-0011-0000-0000-0000000FF1CE}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
    		1 0 0

    RegOpenKeyExW

    		 regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561}
    base_handle: 0x00000368
    key_handle: 0x0000036c
    options: 0
    access: 0x00020019
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
    		1 0 0
    cmdline attrib +H "tea.exe"
    host 46.3.197.102
    file C:\Users\test22\AppData\Local\Temp\ready\7z.exe
    file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
    file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
    Time & API Arguments Status Return Repeated

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: 7-Zip 20.02 alpha
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Adobe AIR
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: EditPlus
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Chrome
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: 한컴오피스 한글 2010
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Mozilla Thunderbird 78.4.0 (x86 ko)
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Professional Plus 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Adobe AIR
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: HttpWatch Professional 9.3.39
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: 한컴오피스 한글 2010
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Java 8 Update 131
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Java Auto Updater
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Google Update Helper
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Access MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Excel MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft PowerPoint MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Publisher MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Outlook MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Word MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Proofing Tools 2013 - English
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Outils de vérification linguistique 2013 de Microsoft Office - Français
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Proofing Tools 2013 - Español
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Proofing (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft InfoPath MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Shared MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft DCF MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft OneNote MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Groove MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office OSM MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office OSM UX MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Shared Setup Metadata MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Access Setup Metadata MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Lync MUI (English) 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Office Professional Plus 2013
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Adobe Flash Player 13 ActiveX
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Adobe Flash Player 13 NPAPI
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Adobe Acrobat Reader DC MUI
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName
    		1 0 0

    RegQueryValueExW

    		 key_handle: 0x0000036c
    regkey_r: DisplayName
    reg_type: 1 (REG_SZ)
    value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
    regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
    		1 0 0
    Process injection Process 2512 resumed a thread in remote process 2956
    Time & API Arguments Status Return Repeated

    NtResumeThread

    		 thread_handle: 0x000000000000006c
    suspend_count: 0
    process_identifier: 2956
    		1 0 0