popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1230.exe

Gen1 VMProtect UPX Malicious Library Malicious Packer OS Processor Check PE File JPEG Format PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 16, 2023, 9:06 a.m. May 16, 2023, 9:08 a.m.
Size 4.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 019cba45c206e0f3606dfb4382d054b1
SHA256 5acc5d15323119465e4a0aa18ee7620b7a84428d708211e77b109c516324754f
CRC32 8C3FC5B4
ssdeep 98304:wUhSwxWUe0BuTmsyJ4DgoiEK/Tb4ZGCX+XZ8jpcDYKH6Q8SJtV:hhLW3EG1CoM/Tbq6Z8jwPbHJ
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • VMProtect_Zero - VMProtect packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.181.10.208 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49162 -> 185.181.10.208:80 2036934 ET MALWARE Win32/RecordBreaker CnC Checkin M1 A Network Trojan was detected
TCP 185.181.10.208:80 -> 192.168.56.103:49162 2036955 ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response A Network Trojan was detected
TCP 192.168.56.103:49162 -> 185.181.10.208:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 185.181.10.208:80 -> 192.168.56.103:49162 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49163 -> 185.181.10.208:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 185.181.10.208:80 -> 192.168.56.103:49163 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49163 -> 185.181.10.208:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 185.181.10.208:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 185.181.10.208:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 185.181.10.208:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 185.181.10.208:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 185.181.10.208:80 2036884 ET HUNTING Possible Generic Stealer Sending System Information Misc activity

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .vmp0
section .vmp1
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://185.181.10.208/
suspicious_features Connection to IP address suspicious_request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
suspicious_features Connection to IP address suspicious_request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
suspicious_features Connection to IP address suspicious_request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
suspicious_features Connection to IP address suspicious_request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
suspicious_features Connection to IP address suspicious_request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
suspicious_features Connection to IP address suspicious_request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
suspicious_features Connection to IP address suspicious_request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://185.181.10.208/38d7d699697c9781f72fa487b05c8044
request POST http://185.181.10.208/
request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
request GET http://185.181.10.208/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
request POST http://185.181.10.208/38d7d699697c9781f72fa487b05c8044
request POST http://185.181.10.208/
request POST http://185.181.10.208/38d7d699697c9781f72fa487b05c8044
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b60000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b70000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\LocalLow\msvcp140.dll
file C:\Users\test22\AppData\LocalLow\softokn3.dll
file C:\Users\test22\AppData\LocalLow\freebl3.dll
file C:\Users\test22\AppData\LocalLow\mozglue.dll
file C:\Users\test22\AppData\LocalLow\vcruntime140.dll
file C:\Users\test22\AppData\LocalLow\sqlite3.dll
file C:\Users\test22\AppData\LocalLow\nss3.dll
file C:\Users\test22\AppData\LocalLow\vcruntime140.dll
file C:\Users\test22\AppData\LocalLow\softokn3.dll
file C:\Users\test22\AppData\LocalLow\nss3.dll
file C:\Users\test22\AppData\LocalLow\msvcp140.dll
file C:\Users\test22\AppData\LocalLow\mozglue.dll
file C:\Users\test22\AppData\LocalLow\freebl3.dll
file C:\Users\test22\AppData\LocalLow\sqlite3.dll
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELöñ9bà"! à&Ð`ýÑ@Aø!\T¿@@x ¸Ph hýð ðÄ\”!@.textiÞà `.rdataäéðêä@@.dataNà*Î@À.00cfg0ø@@.rsrcx@ú@@.reloch P þ@BU‰åSWV‹] ‹u‹~ …ÿt@‹ pàÿ0WÿуÄ‹~ 1À…Û”ÀÁàH‰FD…ÿt‹ xàÿ0WÿуÄ1À^_[]Ã1À…Û”ÀÁàH‰FDëéÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åWVƒì‹uþ3'u7¿’èÿÿƒ=ta¡l‰$ÿ`ǃì…Àt:‰x(‰p,Ç@0ƒÄ^_]ÿ²èÿÿþ~2†çØÿÿƒø8wmÿ$…èx¿¦èÿÿë¨(ñ$èÀë´èI"똁þ揠ƒþoóƒþOIƒþ&ÅFþƒø†€ƒþ …!¿ÐèÿÿéIÿÿÿþ… ¿èÿÿé3ÿÿÿ¿­èÿÿé)ÿÿÿ¿¯èÿÿéÿÿÿ¿¶èÿÿéÿÿÿ¿´èÿÿé ÿÿÿ¿³èÿÿéÿÿÿ¿¢èÿÿé÷þÿÿ¿ èÿÿéíþÿÿ¿×èÿÿéãþÿÿþȏþ폿þå/þç„7þã…u¿Ñèÿÿéþÿÿþa …_¿™èÿÿé‡þÿÿþ“‘ƒþzƒþp„σþx….¿˜èÿÿéVþÿÿþ؏…þϏ߁þÉ…g¿£èÿÿé(þÿÿƒþkÖƒþP…a¿Éèÿÿé þÿÿþ½Êþî…J¿‘èÿÿéêýÿÿþ͏¾þ”„Aÿÿÿþ·t´é“þo¯þÙ…¿Ÿèÿÿé£ýÿÿƒþ'…¿¼èÿÿéýÿÿþæt þé…J¿“èÿÿérýÿÿƒþ{…èÿÿé_ýÿÿþÐ…æ¿ÙèÿÿéIýÿÿƒþl…忺èÿÿé6ýÿÿþ¾…Ú¿žèÿÿé ýÿÿþÎ…Ö¿Áèÿÿé ýÿÿþp„mþÿÿþq„aþÿÿþø…´¿ªèÿÿéÜüÿÿÿ$…˜x¿ÂèÿÿéËüÿÿþÏ…¿¤èÿÿéµüÿÿƒþW„Cÿÿÿëxþg„ þÿÿëjþßub¿ÓèÿÿéŠüÿÿƒþ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ٓ1Cò_ò_ò_)n°Ÿò_”ŠÌ‹ò_ò^"ò_Ϛ^žò_Ϛ\•ò_Ϛ[Óò_ϚZÑò_Ϛ_œò_Ϛ œò_Ϛ]œò_Richò_PEL›(Á[à"! (‚`Ù@ ð„@Ag‚Ïèr ðœ?°¬=`x8¸w@päÀc@.text’&( `.dataH)@,@À.idata¬pD@@.didat4X@À.rsrcð Z@@.reloc¬=°>^@B𢠢€¢à¢£0££p£0¤У°£¤À¤p¤P¤°¤ð¤à¤0¥`¥ ¥€¥P¥€¦À¦ ¦`¦ §à§À§€§°¨ð¨Ш ¨À©ªà©°©àª ««Àª¬@¬ ¬à«­P­0­­®¥ ¥€¢ ¢à¢ð¢£0£p££°£Ð£¤0¤P¤p¤°¤À¤à¤ð¤¥ ¥0¥P¥`¥€¥ ¥`¦€¦ ¦À¦€§ §À§à§ ¨°¨Ð¨ð¨°©À©à©ªÀªàª« «à«¬ ¬@¬­­0­P­®0®°®À¯аà°ð° ±À±²0²@²P²p²€²вP³€³³ð³ ´0µµ°µе¶P¶0·€·p¾€¿ ÀàÅðÆ0РÑÀÑàÑðÓÔÝ@ÞÐßàßààðæ0èPèÀêàêPïð ðò°òÐôðôpööû0ûÐû€üàüPýþàþ`ÿÀÿÐÿðÿ`€0` àÐP`°0P`Р°Ðð 0`pÀ °
request_handle: 0x00cc0018
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ÀÅäՄ¤Š†„¤Š†„¤Š†08e††¤Š†Ü†¤Š†„¤‹†¬¤Š†Ö̉‡—¤Š†Ö̎‡¤Š†Ö̏‡Ÿ¤Š†Ö̊‡…¤Š†ÖÌu†…¤Š†Ö̈‡…¤Š†Rich„¤Š†PEL•(Á[à"! ސÙð 0t(@Aàã ¸Œú?  € 8¸ @´.textôÜÞ `.dataôðâ@À.idata„ä@@.rsrcê@@.reloc  î@B0'à'`-à2@4p5°6(9ø9;0;À;<`= = >0>Q>–>p?Ð?ð?À@pA€DàEJ@ZðZ [0[`[°[\\ \0\@\pe°eàefPj`jpj€jjàj l0làlðmn0nPrÐrÐs`tÐtðtuuPu€u°u€vðvw w@w`w€w x`|}0}@}`}€} }À­Ð­à­ð­0®€À°ÀÐÀðÀ@Á Ò0Ò@ÒPÒàÓÔ ×Ð×°ØðؐÙ@Û°Ü@Ý0߀ߘ@ZX!fPjUnknown exception !fPjbad exceptionì!fPj8"fPj„"fPjAccess violation - no RTTI data!Attempted a typeid of nullptr pointer!Bad read pointer - no RTTI data!Bad dynamic_cast!csmà “8t°api-ms-win-core-fibers-l1-1-1api-ms-win-core-synch-l1-2-0kernel32api-ms-ext-ms-FlsAlloc
request_handle: 0x00cc0024
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELÔñ9bà"! V°/Ð íî @A­¼cQ ,p °r ¸€ 4C°Wh0  ؐ·.textÑ `.rdataœÿ0@@.data¸0  @À.00cfgP  @@.tls` " @À.rsrc°p $ @@.reloc4C€ D. @BU‰åSWVƒì‰Î‹]¡ 0 1è‰EðS芃ĉNjF9øs0ƒì ŠEìˆD$‰\$‰<$‰ñè>‰Æ‹Mð1éè‰ðƒÄ^_[]‰ىóƒør‹‰~WQSèJƒÄ Æ;ëËÌÌÌÌÌÌÌU‰åSWVƒì‹E…Àˆ¦‰Mð‹Y‰ÁƒÉ¾ÿÿÿ¸#€‰]ìxx‰ÚÑê‰×÷ÿÿÿ9ûwhÚ9щÖCñF=sH…À„ŽP葖ƒÄ‰Ç‹Eð‹]‰X‰p‰ÆSÿuWè¸ƒÄ Æ‹Mìƒùs4‰>‰ðƒÄ^_[] ƒøÜwF$ë1ÀHPèD–ƒÄx#ƒçà‰Güëªè“A‹ùr‹HüƒÀü)ȃø s‰ÈPè¡QƒÄ‹uðë¤1ÿ1öNésÿÿÿÿÔ ÌÌÌÌÌÌÌÌÌU‰åSWVÇ…Ò„­‰È‹ …É„¡€I‹z‰þƒæþ„¤‹…ÉtN‹YöÃtFƒãþ‰‹yƒç ÷‰yƒáþ‹rƒæ<‰z…Étv‹9ƒçþ ÷‰z‰‰‹rƒæþt‹^öÃu‰rëƒÏ‰z‹ƒÉ‰J‰‰0^_[]Ããþ‰^‹r‰÷ƒÏ‰zƒæþt&‹>ƒÏ‰z‰‰1ë×ÇhH ò€̹¶èkaƒÏ‰zÇhH ò€̹ èPaÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åSWVÇ…Ò„·‰È‹J…É„ª€I‹z‰þƒæþ„­‹N…Ét‹YöÃuƒÏ‰z‹NƒÉ‰J‰V‰0^_[]Ããþ‰^‹yƒç ÷‰yƒáþ‹rƒæ<‰z…Étd‹yƒçþ ÷‰z‰Q‰‹rƒæþt‹^öÃu‰r벃ãþ‰^‹r‰÷ƒÏ‰zƒæþt)‹~ƒÏ‰z‰V‰që‹ÇhH ò€̹¶èa`ƒÏ‰zÇhH ò€̹ èF`ÌÌÌÌÌU‰åSWVPÇ…Ò„„‹r…ö„y‰È‹N öÁ„†ƒáþ„Y‹y…ÿt öG …÷‹z ƒç ω~ €I ‹J…É„L‹q ƒæþ‰r‰Öƒæþ‹y ƒç ÷‰y ‰‹z
request_handle: 0x00cc0030
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL&ò9bà"! 6°à é @A4, S‡, È  xT ¸° 8$„& 0 ”. D.textÕ `.rdataÄ0@@.data<F@ & @À.00cfg ( @@.rsrcx  * @@.reloc8$° &. @BU‰åhOè2ƒÄ…Àt‰€8ƒÀƒàð]ÃhàÿÿèƒÄ1À]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åWV‹E…Àt‹u‹}‹U‹M …ÿt"òò€0ë(hàÿÿ迃ĸÿÿÿÿë&ǀ4¦¦¦¦Ç€0¦¦¦¦jVjjRQPèO¤ƒÄ^_]ÃÌÌÌÌÌÌÌÌU‰åSWVhOèƒÄ…Àt0‰Ç‰€8ƒÇ1öƒçðtk‹E‹U‹] ‹M…Ûtòò‡0ë%hàÿÿè2ƒÄ1öë<LJ4¦¦¦¦Ç‡0¦¦¦¦jRjjPQWèÅ£ƒÄ…Àtÿ·8èäƒÄë‰þ‰ð^_[]ÃÌÌÌÌÌU‰åWV‹u…öt ‹} jVèɨƒÄ…ÿtÿ¶8訃Ä^_]ÃU‰åSWVƒäøƒìP‰L$,‹M¡´@ 1è‰D$HÇD$4ƒùr‰Èƒàuy;}vhàÿÿé²hàÿÿ騃|$,„˜ƒ}„Ž‹u…ö„ƒ‰Ó‰øƒàøPèƒÄ…À„x‰|$ òòD$8‰ÂƒÂ‰D$$‹}WÁïVRèž‹L$0ƒÄ ÷߉|$01ÀÇD$ÇD$ÇD$ÇD$ÇD$ ÇD$ÇD$1Ûëf.„‹D$(ƒÀ€Ãÿƒø‰ñ„‰D$(€Ã¿ëa‰D$f„‹D$0D$8‹D$0D$9‹D$0D$:‹D$0D$;‹D$ 0D$<‹D$0D$=‹D$0D$>0\$?‹D$0øƒÀƒÇ€Ãƒø„,òùòD$@jD$<PjT$@RPÿt$@‰Î訃ĉ…À…JÿÿÿòD$@òþ„Û‰ñ…eÿÿÿ‹D$þÀ…Lÿÿÿ‹D$þÀu]‹D$ þÀuf‹D$þÀuw‹D$þÀ…Œ‹D$‰D$‹D$‰D$ÇD$ÇD$ÇD$ ÇD$ÇD$éôþÿÿ‰D$ÇD$éãþÿÿ‰D$ ÇD$ÇD$éÊþÿÿ‰D$ÇD$ÇD$ÇD$
request_handle: 0x00cc003c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL'ò9bà"! Ìò€Î¡Þ@AtvSÇwð°€Â¸À˜5hqà D{Œ.textVÊÌ `.rdata¬à®Ð@@.data˜ ~@À.00cfg †@@.rsrc€°ˆ@@.reloc˜5À6Œ@BU‰å¡ š…Àt‹ˆŒÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt‹ˆ$ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt‹ˆ¨ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹H(ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹H,ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹H4ÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt‹ˆÀÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÏÌÌÌU‰å¡ š…Àt ‹H8ÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt ‹H<ÿ ]ÿáh 6hšÿè{ƒÄ…Àt]á šëÔÌÌÌÌÌÌÌÌU‰å¡ š…Àt ‹H@ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹HDÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹HHÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌ
request_handle: 0x00cc0048
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL"©,bv²à!  ú  àaȝ ° n*à Ð  ¨ à;  â Ð.text¬  `P`.data|' ( @`À.rdataDP F: @`@.bss(  €`À.edatan*° ,€ @0@.idataÐ à ¬ @0À.CRT,ð º @0À.tls ¼ @0À.rsrc¨ ¾ @0À.relocà; <Ä @0B/48`  @@B/19RÈp Ê @B/31]'@(Ð @B/45š-p.ø @B/57\   &@0B/70#°2@B/81s:À<6@B/92Pr@BSƒìÇ$€èˆó ‰Ã‰$è¶Ï …Û£ ¨ìa£¨ìat ǃÄ1À[Ãĸ[ÐWVSƒì‹T$$…Òur¡ ìa…ÀŽƒè1ۋ5 ãìa£ ìaëvÇ$èÿփ캉Øð±¨ìa…Àuᡨìaƒø„ãÇ$è7ó ¸ƒÄ[^_ ‰ö¼'ƒú¸uäd¡1ö‹X‹= ãìaëv9Ä Ç$èÿ׃ì‰ðð±¨ìa…ÀuÞ1Û¡¨ìaƒø„!¡¨ìa…À„ñ¡¨ìaƒø„…Û„Ë¡Šìa…Àt‹T$(ÇD$‰T$‹T$ ‰$ÿÐƒì ƒ ìaƒÄ¸[^_ 1Àé7ÿÿÿ‰ö¼'¡ ¨ìa‰$è3Î …À‰ÆtA¡¨ìa‰$è Î ‰Ãƒë9Þw‹…ÀtóƒëÿÐ9Þvñ‰4$èèñ ǨìaÇ ¨ìa1ÀǨìa‡¨ìa¸ƒÄ[^_ »éÿÿÿf
request_handle: 0x00cc0054
1 1 0
section {u'size_of_data': u'0x00409c00', u'virtual_address': u'0x002da000', u'entropy': 7.920266181205409, u'name': u'.vmp1', u'virtual_size': u'0x00409a10'} entropy 7.92026618121 description A section with a high entropy has been found
entropy 0.902937001856 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000001c
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: HashTab
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Firefox 105.0.1 (x64 en-US)
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)
1 0 0

RegOpenKeyExW

 regkey_r: MozillaMaintenanceService
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
1 0 0

RegOpenKeyExW

 regkey_r: {3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}
1 0 0

RegOpenKeyExW

 regkey_r: {50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002A-0000-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0000-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002A-0409-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0409-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0116-0409-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0116-0409-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033
1 0 0

RegOpenKeyExW

 regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042
1 0 0

RegOpenKeyExW

 regkey_r: {A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}
1 0 0

RegOpenKeyExW

 regkey_r: {EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000001c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Adobe AIR
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: EditPlus
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: Google Chrome
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExW

 regkey_r: Haansoft HWord 80 Korean
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExW

 regkey_r: Office15.PROPLUSR
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExW

 regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExW

 regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExW

 regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExW

 regkey_r: {4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x0000001c
key_handle: 0x000002c0
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0
section .vmp0 description Section name indicates VMProtect
section .vmp1 description Section name indicates VMProtect
host 185.181.10.208
Time & API Arguments Status Return Repeated

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 19.00 (x64)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HashTab 6.0.0.34
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Firefox (x64 en-US)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Maintenance Service
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5 KOR Language Pack
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 x64 Minimum Runtime - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office 64-bit Components 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0000-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared 64-bit MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0409-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0116-0409-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5 한국어 언어 팩
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Python 2.7.18 (64-bit)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 x64 Additional Runtime - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002c0
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
FireEye Generic.mg.019cba45c206e0f3
McAfee Artemis!019CBA45C206
Sangfor Infostealer.Win32.Agent.Vd49
K7AntiVirus Trojan ( 7000001c1 )
Alibaba Trojan:Application/VMProtBad.950157ff
K7GW Trojan ( 7000001c1 )
CrowdStrike win/malicious_confidence_90% (W)
BitDefenderTheta Gen:NN.ZexaF.36196.@B0@aCFJOqhi
Symantec ML.Attribute.HighConfidence
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Avast PWSX-gen [Trj]
TrendMicro TrojanSpy.Win32.RACCOONSTEALER.YXDEOZ
McAfee-GW-Edition BehavesLike.Win32.Generic.rc
Trapmine malicious.moderate.ml.score
Sophos Mal/VMProtBad-A
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm UDS:DangerousObject.Multi.Generic
Google Detected
Acronis suspicious
Cylance unsafe
Panda Trj/Chgt.AD
Rising Trojan.Generic@AI.100 (RDML:iMxvzPMcot/89UtWq49ULQ)
MaxSecure Trojan.Malware.300983.susgen
AVG PWSX-gen [Trj]
Cybereason malicious.39ef97
DeepInstinct MALICIOUS