popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

a03.exe

Raccoon Stealer Gen1 VMProtect Malicious Library UPX Malicious Packer AntiDebug PNG Format OS Processor Check JPEG Format PE32 PE File AntiVM DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 24, 2023, 9:10 a.m. May 24, 2023, 9:12 a.m.
Size 6.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 02eceb12980e60c1496eb6b9a02d3483
SHA256 e36099a8ffebc501c3d1b8325a103b62769c5ac2630989ea3ea66715022a062f
CRC32 B8948466
ssdeep 98304:z4S0clXTS9EIv1281Ey0l6iEz0JzA3+rBAlrHC3dNtCLChF:l/lX3I9R1EFlnxJzVA1ALI+hF
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • VMProtect_Zero - VMProtect packed file
  • Raccoon_Stealer_1_Zero - Raccoon Stealer

Name Response Post-Analysis Lookup
iplogger.com
A 148.251.234.93
148.251.234.93
14mmf.za.com
A 104.21.54.36
A 172.67.223.30
172.67.223.30
IP Address Status Action
148.251.234.93 Active Moloch
164.124.101.2 Active Moloch
172.67.223.30 Active Moloch
45.144.28.189 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 148.251.234.93:443 -> 192.168.56.103:49164 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 148.251.234.93:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49161 -> 172.67.223.30:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 45.144.28.189:80 2036934 ET MALWARE Win32/RecordBreaker CnC Checkin M1 A Network Trojan was detected
TCP 45.144.28.189:80 -> 192.168.56.103:49166 2036955 ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response A Network Trojan was detected
TCP 192.168.56.103:49166 -> 45.144.28.189:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 45.144.28.189:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 45.144.28.189:80 -> 192.168.56.103:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 45.144.28.189:80 -> 192.168.56.103:49167 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49167 -> 45.144.28.189:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 45.144.28.189:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 45.144.28.189:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 45.144.28.189:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 45.144.28.189:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 45.144.28.189:80 2036884 ET HUNTING Possible Generic Stealer Sending System Information Misc activity
TCP 192.168.56.103:49167 -> 45.144.28.189:80 2036885 ET HUNTING Possible Generic Stealer Sending a Screenshot Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49161
172.67.223.30:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=14mmf.za.com aa:41:3d:d8:cf:f6:f8:cf:3e:b5:c5:dd:03:65:99:87:f3:4f:f5:36

Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: Pinging 127.0.0.1
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: with 32 bytes of data:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from 127.0.0.1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: bytes=32
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: TTL=128
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Ping statistics for 127.0.0.1: Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://45.144.28.189/
suspicious_features Connection to IP address suspicious_request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
suspicious_features Connection to IP address suspicious_request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
suspicious_features Connection to IP address suspicious_request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
suspicious_features Connection to IP address suspicious_request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
suspicious_features Connection to IP address suspicious_request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
suspicious_features Connection to IP address suspicious_request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
suspicious_features Connection to IP address suspicious_request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://45.144.28.189/302f831c3b8545fb0a5a60bd7a5eeedb
request POST http://45.144.28.189/
request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
request GET http://45.144.28.189/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
request POST http://45.144.28.189/302f831c3b8545fb0a5a60bd7a5eeedb
request GET https://14mmf.za.com/analytics.php?pub=a03&guid=017bd04f-b3bf-45b6-8167-9e8f41ff87bf&sign=178004f0465ebfb5
request POST http://45.144.28.189/
request POST http://45.144.28.189/302f831c3b8545fb0a5a60bd7a5eeedb
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e00000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e10000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e30000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e40000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e50000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e60000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e70000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74131000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74111000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74321000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c21000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76bd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x756f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74fe1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ff1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71c81000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71bf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75201000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76971000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71bb1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71941000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\LocalLow\msvcp140.dll
file C:\Users\test22\AppData\LocalLow\softokn3.dll
file C:\Users\test22\AppData\LocalLow\freebl3.dll
file C:\Users\test22\AppData\LocalLow\mozglue.dll
file C:\Users\test22\AppData\LocalLow\vcruntime140.dll
file C:\Users\test22\AppData\LocalLow\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\wfplwfs.exe
file C:\Users\test22\AppData\Local\Temp\2.1.1.exe
file C:\Users\test22\AppData\LocalLow\nss3.dll
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x000000c4
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 4294967295 ()
share_access: 0 ()
3221225539 0
file C:\Users\test22\AppData\LocalLow\vcruntime140.dll
file C:\Users\test22\AppData\LocalLow\softokn3.dll
file C:\Users\test22\AppData\LocalLow\nss3.dll
file C:\Users\test22\AppData\LocalLow\msvcp140.dll
file C:\Users\test22\AppData\Local\Temp\a03.exe
file C:\Users\test22\AppData\Local\Temp\wfplwfs.exe
file C:\Users\test22\AppData\Local\Temp\2.1.1.exe
file C:\Users\test22\AppData\LocalLow\mozglue.dll
file C:\Users\test22\AppData\LocalLow\freebl3.dll
file C:\Users\test22\AppData\LocalLow\sqlite3.dll
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2820
thread_handle: 0x00000124
process_identifier: 2816
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\wfplwfs.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000120
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2816
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x00e00000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELöñ9bà"! à&Ð`ýÑ@Aø!\T¿@@x ¸Ph hýð ðÄ\”!@.textiÞà `.rdataäéðêä@@.dataNà*Î@À.00cfg0ø@@.rsrcx@ú@@.reloch P þ@BU‰åSWV‹] ‹u‹~ …ÿt@‹ pàÿ0WÿуÄ‹~ 1À…Û”ÀÁàH‰FD…ÿt‹ xàÿ0WÿуÄ1À^_[]Ã1À…Û”ÀÁàH‰FDëéÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åWVƒì‹uþ3'u7¿’èÿÿƒ=ta¡l‰$ÿ`ǃì…Àt:‰x(‰p,Ç@0ƒÄ^_]ÿ²èÿÿþ~2†çØÿÿƒø8wmÿ$…èx¿¦èÿÿë¨(ñ$èÀë´èI"똁þ揠ƒþoóƒþOIƒþ&ÅFþƒø†€ƒþ …!¿ÐèÿÿéIÿÿÿþ… ¿èÿÿé3ÿÿÿ¿­èÿÿé)ÿÿÿ¿¯èÿÿéÿÿÿ¿¶èÿÿéÿÿÿ¿´èÿÿé ÿÿÿ¿³èÿÿéÿÿÿ¿¢èÿÿé÷þÿÿ¿ èÿÿéíþÿÿ¿×èÿÿéãþÿÿþȏþ폿þå/þç„7þã…u¿Ñèÿÿéþÿÿþa …_¿™èÿÿé‡þÿÿþ“‘ƒþzƒþp„σþx….¿˜èÿÿéVþÿÿþ؏…þϏ߁þÉ…g¿£èÿÿé(þÿÿƒþkÖƒþP…a¿Éèÿÿé þÿÿþ½Êþî…J¿‘èÿÿéêýÿÿþ͏¾þ”„Aÿÿÿþ·t´é“þo¯þÙ…¿Ÿèÿÿé£ýÿÿƒþ'…¿¼èÿÿéýÿÿþæt þé…J¿“èÿÿérýÿÿƒþ{…èÿÿé_ýÿÿþÐ…æ¿ÙèÿÿéIýÿÿƒþl…忺èÿÿé6ýÿÿþ¾…Ú¿žèÿÿé ýÿÿþÎ…Ö¿Áèÿÿé ýÿÿþp„mþÿÿþq„aþÿÿþø…´¿ªèÿÿéÜüÿÿÿ$…˜x¿ÂèÿÿéËüÿÿþÏ…¿¤èÿÿéµüÿÿƒþW„Cÿÿÿëxþg„ þÿÿëjþßub¿ÓèÿÿéŠüÿÿƒþ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ٓ1Cò_ò_ò_)n°Ÿò_”ŠÌ‹ò_ò^"ò_Ϛ^žò_Ϛ\•ò_Ϛ[Óò_ϚZÑò_Ϛ_œò_Ϛ œò_Ϛ]œò_Richò_PEL›(Á[à"! (‚`Ù@ ð„@Ag‚Ïèr ðœ?°¬=`x8¸w@päÀc@.text’&( `.dataH)@,@À.idata¬pD@@.didat4X@À.rsrcð Z@@.reloc¬=°>^@B𢠢€¢à¢£0££p£0¤У°£¤À¤p¤P¤°¤ð¤à¤0¥`¥ ¥€¥P¥€¦À¦ ¦`¦ §à§À§€§°¨ð¨Ш ¨À©ªà©°©àª ««Àª¬@¬ ¬à«­P­0­­®¥ ¥€¢ ¢à¢ð¢£0£p££°£Ð£¤0¤P¤p¤°¤À¤à¤ð¤¥ ¥0¥P¥`¥€¥ ¥`¦€¦ ¦À¦€§ §À§à§ ¨°¨Ð¨ð¨°©À©à©ªÀªàª« «à«¬ ¬@¬­­0­P­®0®°®À¯аà°ð° ±À±²0²@²P²p²€²вP³€³³ð³ ´0µµ°µе¶P¶0·€·p¾€¿ ÀàÅðÆ0РÑÀÑàÑðÓÔÝ@ÞÐßàßààðæ0èPèÀêàêPïð ðò°òÐôðôpööû0ûÐû€üàüPýþàþ`ÿÀÿÐÿðÿ`€0` àÐP`°0P`Р°Ðð 0`pÀ °
request_handle: 0x00cc0018
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ÀÅäՄ¤Š†„¤Š†„¤Š†08e††¤Š†Ü†¤Š†„¤‹†¬¤Š†Ö̉‡—¤Š†Ö̎‡¤Š†Ö̏‡Ÿ¤Š†Ö̊‡…¤Š†ÖÌu†…¤Š†Ö̈‡…¤Š†Rich„¤Š†PEL•(Á[à"! ސÙð 0t(@Aàã ¸Œú?  € 8¸ @´.textôÜÞ `.dataôðâ@À.idata„ä@@.rsrcê@@.reloc  î@B0'à'`-à2@4p5°6(9ø9;0;À;<`= = >0>Q>–>p?Ð?ð?À@pA€DàEJ@ZðZ [0[`[°[\\ \0\@\pe°eàefPj`jpj€jjàj l0làlðmn0nPrÐrÐs`tÐtðtuuPu€u°u€vðvw w@w`w€w x`|}0}@}`}€} }À­Ð­à­ð­0®€À°ÀÐÀðÀ@Á Ò0Ò@ÒPÒàÓÔ ×Ð×°ØðؐÙ@Û°Ü@Ý0߀ߘ@ZX!fPjUnknown exception !fPjbad exceptionì!fPj8"fPj„"fPjAccess violation - no RTTI data!Attempted a typeid of nullptr pointer!Bad read pointer - no RTTI data!Bad dynamic_cast!csmà “8t°api-ms-win-core-fibers-l1-1-1api-ms-win-core-synch-l1-2-0kernel32api-ms-ext-ms-FlsAlloc
request_handle: 0x00cc0024
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELÔñ9bà"! V°/Ð íî @A­¼cQ ,p °r ¸€ 4C°Wh0  ؐ·.textÑ `.rdataœÿ0@@.data¸0  @À.00cfgP  @@.tls` " @À.rsrc°p $ @@.reloc4C€ D. @BU‰åSWVƒì‰Î‹]¡ 0 1è‰EðS芃ĉNjF9øs0ƒì ŠEìˆD$‰\$‰<$‰ñè>‰Æ‹Mð1éè‰ðƒÄ^_[]‰ىóƒør‹‰~WQSèJƒÄ Æ;ëËÌÌÌÌÌÌÌU‰åSWVƒì‹E…Àˆ¦‰Mð‹Y‰ÁƒÉ¾ÿÿÿ¸#€‰]ìxx‰ÚÑê‰×÷ÿÿÿ9ûwhÚ9щÖCñF=sH…À„ŽP葖ƒÄ‰Ç‹Eð‹]‰X‰p‰ÆSÿuWè¸ƒÄ Æ‹Mìƒùs4‰>‰ðƒÄ^_[] ƒøÜwF$ë1ÀHPèD–ƒÄx#ƒçà‰Güëªè“A‹ùr‹HüƒÀü)ȃø s‰ÈPè¡QƒÄ‹uðë¤1ÿ1öNésÿÿÿÿÔ ÌÌÌÌÌÌÌÌÌU‰åSWVÇ…Ò„­‰È‹ …É„¡€I‹z‰þƒæþ„¤‹…ÉtN‹YöÃtFƒãþ‰‹yƒç ÷‰yƒáþ‹rƒæ<‰z…Étv‹9ƒçþ ÷‰z‰‰‹rƒæþt‹^öÃu‰rëƒÏ‰z‹ƒÉ‰J‰‰0^_[]Ããþ‰^‹r‰÷ƒÏ‰zƒæþt&‹>ƒÏ‰z‰‰1ë×ÇhH ò€̹¶èkaƒÏ‰zÇhH ò€̹ èPaÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åSWVÇ…Ò„·‰È‹J…É„ª€I‹z‰þƒæþ„­‹N…Ét‹YöÃuƒÏ‰z‹NƒÉ‰J‰V‰0^_[]Ããþ‰^‹yƒç ÷‰yƒáþ‹rƒæ<‰z…Étd‹yƒçþ ÷‰z‰Q‰‹rƒæþt‹^öÃu‰r벃ãþ‰^‹r‰÷ƒÏ‰zƒæþt)‹~ƒÏ‰z‰V‰që‹ÇhH ò€̹¶èa`ƒÏ‰zÇhH ò€̹ èF`ÌÌÌÌÌU‰åSWVPÇ…Ò„„‹r…ö„y‰È‹N öÁ„†ƒáþ„Y‹y…ÿt öG …÷‹z ƒç ω~ €I ‹J…É„L‹q ƒæþ‰r‰Öƒæþ‹y ƒç ÷‰y ‰‹z
request_handle: 0x00cc0030
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL&ò9bà"! 6°à é @A4, S‡, È  xT ¸° 8$„& 0 ”. D.textÕ `.rdataÄ0@@.data<F@ & @À.00cfg ( @@.rsrcx  * @@.reloc8$° &. @BU‰åhOè2ƒÄ…Àt‰€8ƒÀƒàð]ÃhàÿÿèƒÄ1À]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åWV‹E…Àt‹u‹}‹U‹M …ÿt"òò€0ë(hàÿÿ迃ĸÿÿÿÿë&ǀ4¦¦¦¦Ç€0¦¦¦¦jVjjRQPèO¤ƒÄ^_]ÃÌÌÌÌÌÌÌÌU‰åSWVhOèƒÄ…Àt0‰Ç‰€8ƒÇ1öƒçðtk‹E‹U‹] ‹M…Ûtòò‡0ë%hàÿÿè2ƒÄ1öë<LJ4¦¦¦¦Ç‡0¦¦¦¦jRjjPQWèÅ£ƒÄ…Àtÿ·8èäƒÄë‰þ‰ð^_[]ÃÌÌÌÌÌU‰åWV‹u…öt ‹} jVèɨƒÄ…ÿtÿ¶8訃Ä^_]ÃU‰åSWVƒäøƒìP‰L$,‹M¡´@ 1è‰D$HÇD$4ƒùr‰Èƒàuy;}vhàÿÿé²hàÿÿ騃|$,„˜ƒ}„Ž‹u…ö„ƒ‰Ó‰øƒàøPèƒÄ…À„x‰|$ òòD$8‰ÂƒÂ‰D$$‹}WÁïVRèž‹L$0ƒÄ ÷߉|$01ÀÇD$ÇD$ÇD$ÇD$ÇD$ ÇD$ÇD$1Ûëf.„‹D$(ƒÀ€Ãÿƒø‰ñ„‰D$(€Ã¿ëa‰D$f„‹D$0D$8‹D$0D$9‹D$0D$:‹D$0D$;‹D$ 0D$<‹D$0D$=‹D$0D$>0\$?‹D$0øƒÀƒÇ€Ãƒø„,òùòD$@jD$<PjT$@RPÿt$@‰Î訃ĉ…À…JÿÿÿòD$@òþ„Û‰ñ…eÿÿÿ‹D$þÀ…Lÿÿÿ‹D$þÀu]‹D$ þÀuf‹D$þÀuw‹D$þÀ…Œ‹D$‰D$‹D$‰D$ÇD$ÇD$ÇD$ ÇD$ÇD$éôþÿÿ‰D$ÇD$éãþÿÿ‰D$ ÇD$ÇD$éÊþÿÿ‰D$ÇD$ÇD$ÇD$
request_handle: 0x00cc003c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL'ò9bà"! Ìò€Î¡Þ@AtvSÇwð°€Â¸À˜5hqà D{Œ.textVÊÌ `.rdata¬à®Ð@@.data˜ ~@À.00cfg †@@.rsrc€°ˆ@@.reloc˜5À6Œ@BU‰å¡ š…Àt‹ˆŒÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt‹ˆ$ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt‹ˆ¨ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹H(ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹H,ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹H4ÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt‹ˆÀÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÏÌÌÌU‰å¡ š…Àt ‹H8ÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt ‹H<ÿ ]ÿáh 6hšÿè{ƒÄ…Àt]á šëÔÌÌÌÌÌÌÌÌU‰å¡ š…Àt ‹H@ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹HDÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹HHÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌ
request_handle: 0x00cc0048
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL"©,bv²à!  ú  àaȝ ° n*à Ð  ¨ à;  â Ð.text¬  `P`.data|' ( @`À.rdataDP F: @`@.bss(  €`À.edatan*° ,€ @0@.idataÐ à ¬ @0À.CRT,ð º @0À.tls ¼ @0À.rsrc¨ ¾ @0À.relocà; <Ä @0B/48`  @@B/19RÈp Ê @B/31]'@(Ð @B/45š-p.ø @B/57\   &@0B/70#°2@B/81s:À<6@B/92Pr@BSƒìÇ$€èˆó ‰Ã‰$è¶Ï …Û£ ¨ìa£¨ìat ǃÄ1À[Ãĸ[ÐWVSƒì‹T$$…Òur¡ ìa…ÀŽƒè1ۋ5 ãìa£ ìaëvÇ$èÿփ캉Øð±¨ìa…Àuᡨìaƒø„ãÇ$è7ó ¸ƒÄ[^_ ‰ö¼'ƒú¸uäd¡1ö‹X‹= ãìaëv9Ä Ç$èÿ׃ì‰ðð±¨ìa…ÀuÞ1Û¡¨ìaƒø„!¡¨ìa…À„ñ¡¨ìaƒø„…Û„Ë¡Šìa…Àt‹T$(ÇD$‰T$‹T$ ‰$ÿÐƒì ƒ ìaƒÄ¸[^_ 1Àé7ÿÿÿ‰ö¼'¡ ¨ìa‰$è3Î …À‰ÆtA¡¨ìa‰$è Î ‰Ãƒë9Þw‹…ÀtóƒëÿÐ9Þvñ‰4$èèñ ǨìaÇ ¨ìa1ÀǨìa‡¨ìa¸ƒÄ[^_ »éÿÿÿf
request_handle: 0x00cc0054
1 1 0
section {u'size_of_data': u'0x0056f000', u'virtual_address': u'0x0000f000', u'entropy': 7.954696693201262, u'name': u'.rdata', u'virtual_size': u'0x0056ec80'} entropy 7.9546966932 description A section with a high entropy has been found
entropy 0.910936476752 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vba
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000001c
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: HashTab
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Firefox 105.0.1 (x64 en-US)
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)
1 0 0

RegOpenKeyExW

 regkey_r: MozillaMaintenanceService
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
1 0 0

RegOpenKeyExW

 regkey_r: {3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}
1 0 0

RegOpenKeyExW

 regkey_r: {50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002A-0000-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0000-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002A-0409-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0409-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0116-0409-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0116-0409-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033
1 0 0

RegOpenKeyExW

 regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042
1 0 0

RegOpenKeyExW

 regkey_r: {A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}
1 0 0

RegOpenKeyExW

 regkey_r: {EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000001c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Adobe AIR
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: EditPlus
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: Google Chrome
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExW

 regkey_r: Haansoft HWord 80 Korean
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExW

 regkey_r: Office15.PROPLUSR
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExW

 regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExW

 regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExW

 regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExW

 regkey_r: {4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x0000001c
key_handle: 0x000002e4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0
cmdline ping 127.0.0.1 -n 3
cmdline cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\test22\AppData\Local\Temp\a03.exe"
buffer Buffer with sha1: 2df9037fb29129ad27a4f2cf88cee132e272e28e
host 45.144.28.189
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3036
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000018c
1 0 0
Time & API Arguments Status Return Repeated

FindWindowA

 class_name: ThunderRT6FormDC
window_name: Operators Network Error Check
0 0

FindWindowA

 class_name: ThunderRT6FormDC
window_name: Operators Network Error Check
1 65890 0

FindWindowA

 class_name: ThunderRT6FormDC
window_name: Operators Network Error Check
1 65890 0

FindWindowA

 class_name: ThunderRT6FormDC
window_name: Operators Network Error Check
1 65890 0

FindWindowA

 class_name: ThunderRT6FormDC
window_name: Operators Network Error Check
1 65890 0

FindWindowA

 class_name: ThunderRT6FormDC
window_name: Operators Network Error Check
1 65890 0
file C:\Windows\Tasks\1d896d6f4de8430f.job
Time & API Arguments Status Return Repeated

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 19.00 (x64)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HashTab 6.0.0.34
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Firefox (x64 en-US)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Maintenance Service
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5 KOR Language Pack
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 x64 Minimum Runtime - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office 64-bit Components 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0000-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared 64-bit MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0409-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0116-0409-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5 한국어 언어 팩
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Python 2.7.18 (64-bit)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 x64 Additional Runtime - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Process injection Process 2816 called NtSetContextThread to modify thread in remote process 3036
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1178512
registers.edi: 0
registers.eax: 4199668
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000188
process_identifier: 3036
1 0 0
Process injection Process 2816 resumed a thread in remote process 3036
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000188
suspend_count: 1
process_identifier: 3036
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2132
thread_handle: 0x00000394
process_identifier: 2128
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\2.1.1.exe
filepath_r:
stack_pivoted: 0
creation_flags: 16 (CREATE_NEW_CONSOLE)
inherit_handles: 0
process_handle: 0x000003a0
1 1 0

CreateProcessInternalW

 thread_identifier: 2820
thread_handle: 0x00000124
process_identifier: 2816
current_directory:
filepath:
track: 1
command_line: C:\Users\test22\AppData\Local\Temp\wfplwfs.exe
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000120
1 1 0

CreateProcessInternalW

 thread_identifier: 2856
thread_handle: 0x00000120
process_identifier: 2852
current_directory:
filepath:
track: 1
command_line: cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\test22\AppData\Local\Temp\a03.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 0 ()
inherit_handles: 0
process_handle: 0x00000124
1 1 0

NtResumeThread

 thread_handle: 0x000000f4
suspend_count: 1
process_identifier: 2816
1 0 0

CreateProcessInternalW

 thread_identifier: 3040
thread_handle: 0x00000188
process_identifier: 3036
current_directory:
filepath:
track: 1
command_line: C:\Windows\system32\rundll32.exe
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000018c
1 1 0

NtGetContextThread

 thread_handle: 0x00000188
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3036
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000018c
1 0 0

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1178512
registers.edi: 0
registers.eax: 4199668
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000188
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x00000188
suspend_count: 1
process_identifier: 3036
1 0 0

CreateProcessInternalW

 thread_identifier: 2932
thread_handle: 0x00000084
process_identifier: 2928
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\PING.EXE
track: 1
command_line: ping 127.0.0.1 -n 3
filepath_r: C:\Windows\system32\PING.EXE
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2928
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 3036
1 0 0

NtResumeThread

 thread_handle: 0x0000031c
suspend_count: 1
process_identifier: 3036
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Raccoon.4!c
MicroWorld-eScan Gen:Variant.Fragtor.289150
ALYac Gen:Variant.Fragtor.289150
Malwarebytes Malware.AI.3065879201
Sangfor Trojan.Win32.Fragtor.V5se
K7AntiVirus Trojan ( 0056e5201 )
Alibaba TrojanPSW:Win32/Raccoon.6c2640dd
K7GW Trojan ( 0056e5201 )
Cybereason malicious.0da875
Arcabit Trojan.Fragtor.D4697E
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 multiple detections
Cynet Malicious (score: 99)
APEX Malicious
Kaspersky HEUR:Trojan-PSW.Win32.Raccoon.gen
BitDefender Gen:Variant.Fragtor.289150
Avast Win32:Evo-gen [Trj]
Tencent Win32.Trojan-QQPass.QQRob.Psmw
Emsisoft Gen:Variant.Fragtor.289150 (B)
F-Secure Trojan.TR/AD.Nekark.lfcoo
VIPRE Gen:Variant.Fragtor.289150
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
FireEye Generic.mg.02eceb12980e60c1
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Avira TR/AD.Nekark.lfcoo
MAX malware (ai score=82)
Antiy-AVL Trojan[PSW]/Win32.Raccoon
Microsoft Trojan:Win32/Raccoon.CREC!MTB
ZoneAlarm HEUR:Trojan-PSW.Win32.Raccoon.gen
GData Gen:Variant.Fragtor.289150
AhnLab-V3 Trojan/Win.Raccoon.C5432015
McAfee Artemis!02ECEB12980E
VBA32 BScope.TrojanDownloader.Agent
Cylance unsafe
Rising Trojan.Generic@AI.100 (RDML:fhOnm/cY/Nd8ag8Z8AxoUg)
BitDefenderTheta Gen:NN.ZexaF.36196.@tW@a41Ad8ji
AVG Win32:Evo-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_90% (W)