popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

game.exe

Gen1 .NET framework(MSIL) UPX Malicious Library Malicious Packer PWS OS Processor Check AntiDebug PE File PE32 .NET EXE AntiVM DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 19, 2023, 7:43 a.m. June 19, 2023, 7:48 a.m.
Size 336.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 e94ec358349808b167fe25704bbb1c43
SHA256 f63154fccd7521dbe450f56aefff2a73d199489f8b68be7bd03befc5a98ddc36
CRC32 13CCB4CB
ssdeep 6144:b46HZImXdPNhShn6XpLaJba4XcwfkBYuOVx6rfWd+V9nJ2/FnRy5pg:b46HZlXXhOnY9a9PswfkBYuo0DLnJ2dP
Yara
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
5.42.64.17 Active Moloch
77.91.68.63 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 5.42.64.17:80 2036934 ET MALWARE Win32/RecordBreaker CnC Checkin M1 A Network Trojan was detected
TCP 5.42.64.17:80 -> 192.168.56.103:49164 2036955 ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.42.64.17:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 5.42.64.17:80 2044305 ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 5.42.64.17:80 -> 192.168.56.103:49164 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 5.42.64.17:80 -> 192.168.56.103:49165 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2044307 ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2044302 ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2044303 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2044306 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2044301 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 5.42.64.17:80 2036884 ET HUNTING Possible Generic Stealer Sending System Information Misc activity

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004258c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00425900
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00425900
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00425900
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00425900
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00425900
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .sdata
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://5.42.64.17/
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
suspicious_features Connection to IP address suspicious_request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://5.42.64.17/50404579ee07953eb087d9c143270c92
request POST http://5.42.64.17/
request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
request GET http://5.42.64.17/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
request POST http://5.42.64.17/50404579ee07953eb087d9c143270c92
request POST http://5.42.64.17/
request POST http://5.42.64.17/50404579ee07953eb087d9c143270c92
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00500000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00562000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00595000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00597000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00950000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00951000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00586000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00957000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00587000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0056c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0096f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00960000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00958000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00959000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\LocalLow\msvcp140.dll
file C:\Users\test22\AppData\LocalLow\softokn3.dll
file C:\Users\test22\AppData\LocalLow\freebl3.dll
file C:\Users\test22\AppData\LocalLow\mozglue.dll
file C:\Users\test22\AppData\LocalLow\vcruntime140.dll
file C:\Users\test22\AppData\LocalLow\sqlite3.dll
file C:\Users\test22\AppData\LocalLow\nss3.dll
file C:\Users\test22\AppData\LocalLow\vcruntime140.dll
file C:\Users\test22\AppData\LocalLow\softokn3.dll
file C:\Users\test22\AppData\LocalLow\nss3.dll
file C:\Users\test22\AppData\LocalLow\msvcp140.dll
file C:\Users\test22\AppData\LocalLow\mozglue.dll
file C:\Users\test22\AppData\LocalLow\freebl3.dll
file C:\Users\test22\AppData\LocalLow\sqlite3.dll
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELöñ9bà"! à&Ð`ýÑ@Aø!\T¿@@x ¸Ph hýð ðÄ\”!@.textiÞà `.rdataäéðêä@@.dataNà*Î@À.00cfg0ø@@.rsrcx@ú@@.reloch P þ@BU‰åSWV‹] ‹u‹~ …ÿt@‹ pàÿ0WÿуÄ‹~ 1À…Û”ÀÁàH‰FD…ÿt‹ xàÿ0WÿуÄ1À^_[]Ã1À…Û”ÀÁàH‰FDëéÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åWVƒì‹uþ3'u7¿’èÿÿƒ=ta¡l‰$ÿ`ǃì…Àt:‰x(‰p,Ç@0ƒÄ^_]ÿ²èÿÿþ~2†çØÿÿƒø8wmÿ$…èx¿¦èÿÿë¨(ñ$èÀë´èI"똁þ揠ƒþoóƒþOIƒþ&ÅFþƒø†€ƒþ …!¿ÐèÿÿéIÿÿÿþ… ¿èÿÿé3ÿÿÿ¿­èÿÿé)ÿÿÿ¿¯èÿÿéÿÿÿ¿¶èÿÿéÿÿÿ¿´èÿÿé ÿÿÿ¿³èÿÿéÿÿÿ¿¢èÿÿé÷þÿÿ¿ èÿÿéíþÿÿ¿×èÿÿéãþÿÿþȏþ폿þå/þç„7þã…u¿Ñèÿÿéþÿÿþa …_¿™èÿÿé‡þÿÿþ“‘ƒþzƒþp„σþx….¿˜èÿÿéVþÿÿþ؏…þϏ߁þÉ…g¿£èÿÿé(þÿÿƒþkÖƒþP…a¿Éèÿÿé þÿÿþ½Êþî…J¿‘èÿÿéêýÿÿþ͏¾þ”„Aÿÿÿþ·t´é“þo¯þÙ…¿Ÿèÿÿé£ýÿÿƒþ'…¿¼èÿÿéýÿÿþæt þé…J¿“èÿÿérýÿÿƒþ{…èÿÿé_ýÿÿþÐ…æ¿ÙèÿÿéIýÿÿƒþl…忺èÿÿé6ýÿÿþ¾…Ú¿žèÿÿé ýÿÿþÎ…Ö¿Áèÿÿé ýÿÿþp„mþÿÿþq„aþÿÿþø…´¿ªèÿÿéÜüÿÿÿ$…˜x¿ÂèÿÿéËüÿÿþÏ…¿¤èÿÿéµüÿÿƒþW„Cÿÿÿëxþg„ þÿÿëjþßub¿ÓèÿÿéŠüÿÿƒþ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ٓ1Cò_ò_ò_)n°Ÿò_”ŠÌ‹ò_ò^"ò_Ϛ^žò_Ϛ\•ò_Ϛ[Óò_ϚZÑò_Ϛ_œò_Ϛ œò_Ϛ]œò_Richò_PEL›(Á[à"! (‚`Ù@ ð„@Ag‚Ïèr ðœ?°¬=`x8¸w@päÀc@.text’&( `.dataH)@,@À.idata¬pD@@.didat4X@À.rsrcð Z@@.reloc¬=°>^@B𢠢€¢à¢£0££p£0¤У°£¤À¤p¤P¤°¤ð¤à¤0¥`¥ ¥€¥P¥€¦À¦ ¦`¦ §à§À§€§°¨ð¨Ш ¨À©ªà©°©àª ««Àª¬@¬ ¬à«­P­0­­®¥ ¥€¢ ¢à¢ð¢£0£p££°£Ð£¤0¤P¤p¤°¤À¤à¤ð¤¥ ¥0¥P¥`¥€¥ ¥`¦€¦ ¦À¦€§ §À§à§ ¨°¨Ð¨ð¨°©À©à©ªÀªàª« «à«¬ ¬@¬­­0­P­®0®°®À¯аà°ð° ±À±²0²@²P²p²€²вP³€³³ð³ ´0µµ°µе¶P¶0·€·p¾€¿ ÀàÅðÆ0РÑÀÑàÑðÓÔÝ@ÞÐßàßààðæ0èPèÀêàêPïð ðò°òÐôðôpööû0ûÐû€üàüPýþàþ`ÿÀÿÐÿðÿ`€0` àÐP`°0P`Р°Ðð 0`pÀ °
request_handle: 0x00cc0018
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ÀÅäՄ¤Š†„¤Š†„¤Š†08e††¤Š†Ü†¤Š†„¤‹†¬¤Š†Ö̉‡—¤Š†Ö̎‡¤Š†Ö̏‡Ÿ¤Š†Ö̊‡…¤Š†ÖÌu†…¤Š†Ö̈‡…¤Š†Rich„¤Š†PEL•(Á[à"! ސÙð 0t(@Aàã ¸Œú?  € 8¸ @´.textôÜÞ `.dataôðâ@À.idata„ä@@.rsrcê@@.reloc  î@B0'à'`-à2@4p5°6(9ø9;0;À;<`= = >0>Q>–>p?Ð?ð?À@pA€DàEJ@ZðZ [0[`[°[\\ \0\@\pe°eàefPj`jpj€jjàj l0làlðmn0nPrÐrÐs`tÐtðtuuPu€u°u€vðvw w@w`w€w x`|}0}@}`}€} }À­Ð­à­ð­0®€À°ÀÐÀðÀ@Á Ò0Ò@ÒPÒàÓÔ ×Ð×°ØðؐÙ@Û°Ü@Ý0߀ߘ@ZX!fPjUnknown exception !fPjbad exceptionì!fPj8"fPj„"fPjAccess violation - no RTTI data!Attempted a typeid of nullptr pointer!Bad read pointer - no RTTI data!Bad dynamic_cast!csmà “8t°api-ms-win-core-fibers-l1-1-1api-ms-win-core-synch-l1-2-0kernel32api-ms-ext-ms-FlsAlloc
request_handle: 0x00cc0024
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELÔñ9bà"! V°/Ð íî @A­¼cQ ,p °r ¸€ 4C°Wh0  ؐ·.textÑ `.rdataœÿ0@@.data¸0  @À.00cfgP  @@.tls` " @À.rsrc°p $ @@.reloc4C€ D. @BU‰åSWVƒì‰Î‹]¡ 0 1è‰EðS芃ĉNjF9øs0ƒì ŠEìˆD$‰\$‰<$‰ñè>‰Æ‹Mð1éè‰ðƒÄ^_[]‰ىóƒør‹‰~WQSèJƒÄ Æ;ëËÌÌÌÌÌÌÌU‰åSWVƒì‹E…Àˆ¦‰Mð‹Y‰ÁƒÉ¾ÿÿÿ¸#€‰]ìxx‰ÚÑê‰×÷ÿÿÿ9ûwhÚ9щÖCñF=sH…À„ŽP葖ƒÄ‰Ç‹Eð‹]‰X‰p‰ÆSÿuWè¸ƒÄ Æ‹Mìƒùs4‰>‰ðƒÄ^_[] ƒøÜwF$ë1ÀHPèD–ƒÄx#ƒçà‰Güëªè“A‹ùr‹HüƒÀü)ȃø s‰ÈPè¡QƒÄ‹uðë¤1ÿ1öNésÿÿÿÿÔ ÌÌÌÌÌÌÌÌÌU‰åSWVÇ…Ò„­‰È‹ …É„¡€I‹z‰þƒæþ„¤‹…ÉtN‹YöÃtFƒãþ‰‹yƒç ÷‰yƒáþ‹rƒæ<‰z…Étv‹9ƒçþ ÷‰z‰‰‹rƒæþt‹^öÃu‰rëƒÏ‰z‹ƒÉ‰J‰‰0^_[]Ããþ‰^‹r‰÷ƒÏ‰zƒæþt&‹>ƒÏ‰z‰‰1ë×ÇhH ò€̹¶èkaƒÏ‰zÇhH ò€̹ èPaÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åSWVÇ…Ò„·‰È‹J…É„ª€I‹z‰þƒæþ„­‹N…Ét‹YöÃuƒÏ‰z‹NƒÉ‰J‰V‰0^_[]Ããþ‰^‹yƒç ÷‰yƒáþ‹rƒæ<‰z…Étd‹yƒçþ ÷‰z‰Q‰‹rƒæþt‹^öÃu‰r벃ãþ‰^‹r‰÷ƒÏ‰zƒæþt)‹~ƒÏ‰z‰V‰që‹ÇhH ò€̹¶èa`ƒÏ‰zÇhH ò€̹ èF`ÌÌÌÌÌU‰åSWVPÇ…Ò„„‹r…ö„y‰È‹N öÁ„†ƒáþ„Y‹y…ÿt öG …÷‹z ƒç ω~ €I ‹J…É„L‹q ƒæþ‰r‰Öƒæþ‹y ƒç ÷‰y ‰‹z
request_handle: 0x00cc0030
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL&ò9bà"! 6°à é @A4, S‡, È  xT ¸° 8$„& 0 ”. D.textÕ `.rdataÄ0@@.data<F@ & @À.00cfg ( @@.rsrcx  * @@.reloc8$° &. @BU‰åhOè2ƒÄ…Àt‰€8ƒÀƒàð]ÃhàÿÿèƒÄ1À]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åWV‹E…Àt‹u‹}‹U‹M …ÿt"òò€0ë(hàÿÿ迃ĸÿÿÿÿë&ǀ4¦¦¦¦Ç€0¦¦¦¦jVjjRQPèO¤ƒÄ^_]ÃÌÌÌÌÌÌÌÌU‰åSWVhOèƒÄ…Àt0‰Ç‰€8ƒÇ1öƒçðtk‹E‹U‹] ‹M…Ûtòò‡0ë%hàÿÿè2ƒÄ1öë<LJ4¦¦¦¦Ç‡0¦¦¦¦jRjjPQWèÅ£ƒÄ…Àtÿ·8èäƒÄë‰þ‰ð^_[]ÃÌÌÌÌÌU‰åWV‹u…öt ‹} jVèɨƒÄ…ÿtÿ¶8訃Ä^_]ÃU‰åSWVƒäøƒìP‰L$,‹M¡´@ 1è‰D$HÇD$4ƒùr‰Èƒàuy;}vhàÿÿé²hàÿÿ騃|$,„˜ƒ}„Ž‹u…ö„ƒ‰Ó‰øƒàøPèƒÄ…À„x‰|$ òòD$8‰ÂƒÂ‰D$$‹}WÁïVRèž‹L$0ƒÄ ÷߉|$01ÀÇD$ÇD$ÇD$ÇD$ÇD$ ÇD$ÇD$1Ûëf.„‹D$(ƒÀ€Ãÿƒø‰ñ„‰D$(€Ã¿ëa‰D$f„‹D$0D$8‹D$0D$9‹D$0D$:‹D$0D$;‹D$ 0D$<‹D$0D$=‹D$0D$>0\$?‹D$0øƒÀƒÇ€Ãƒø„,òùòD$@jD$<PjT$@RPÿt$@‰Î訃ĉ…À…JÿÿÿòD$@òþ„Û‰ñ…eÿÿÿ‹D$þÀ…Lÿÿÿ‹D$þÀu]‹D$ þÀuf‹D$þÀuw‹D$þÀ…Œ‹D$‰D$‹D$‰D$ÇD$ÇD$ÇD$ ÇD$ÇD$éôþÿÿ‰D$ÇD$éãþÿÿ‰D$ ÇD$ÇD$éÊþÿÿ‰D$ÇD$ÇD$ÇD$
request_handle: 0x00cc003c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL'ò9bà"! Ìò€Î¡Þ@AtvSÇwð°€Â¸À˜5hqà D{Œ.textVÊÌ `.rdata¬à®Ð@@.data˜ ~@À.00cfg †@@.rsrc€°ˆ@@.reloc˜5À6Œ@BU‰å¡ š…Àt‹ˆŒÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt‹ˆ$ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt‹ˆ¨ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹H(ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹H,ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹H4ÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt‹ˆÀÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÏÌÌÌU‰å¡ š…Àt ‹H8ÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt ‹H<ÿ ]ÿáh 6hšÿè{ƒÄ…Àt]á šëÔÌÌÌÌÌÌÌÌU‰å¡ š…Àt ‹H@ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹HDÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹HHÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌ
request_handle: 0x00cc0048
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL"©,bv²à!  ú  àaȝ ° n*à Ð  ¨ à;  â Ð.text¬  `P`.data|' ( @`À.rdataDP F: @`@.bss(  €`À.edatan*° ,€ @0@.idataÐ à ¬ @0À.CRT,ð º @0À.tls ¼ @0À.rsrc¨ ¾ @0À.relocà; <Ä @0B/48`  @@B/19RÈp Ê @B/31]'@(Ð @B/45š-p.ø @B/57\   &@0B/70#°2@B/81s:À<6@B/92Pr@BSƒìÇ$€èˆó ‰Ã‰$è¶Ï …Û£ ¨ìa£¨ìat ǃÄ1À[Ãĸ[ÐWVSƒì‹T$$…Òur¡ ìa…ÀŽƒè1ۋ5 ãìa£ ìaëvÇ$èÿփ캉Øð±¨ìa…Àuᡨìaƒø„ãÇ$è7ó ¸ƒÄ[^_ ‰ö¼'ƒú¸uäd¡1ö‹X‹= ãìaëv9Ä Ç$èÿ׃ì‰ðð±¨ìa…ÀuÞ1Û¡¨ìaƒø„!¡¨ìa…À„ñ¡¨ìaƒø„…Û„Ë¡Šìa…Àt‹T$(ÇD$‰T$‹T$ ‰$ÿÐƒì ƒ ìaƒÄ¸[^_ 1Àé7ÿÿÿ‰ö¼'¡ ¨ìa‰$è3Î …À‰ÆtA¡¨ìa‰$è Î ‰Ãƒë9Þw‹…ÀtóƒëÿÐ9Þvñ‰4$èèñ ǨìaÇ ¨ìa1ÀǨìa‡¨ìa¸ƒÄ[^_ »éÿÿÿf
request_handle: 0x00cc0054
1 1 0
section {u'size_of_data': u'0x00049e00', u'virtual_address': u'0x00002000', u'entropy': 7.679067414569904, u'name': u'.text', u'virtual_size': u'0x00049d54'} entropy 7.67906741457 description A section with a high entropy has been found
entropy 0.880774962742 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000001c
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: HashTab
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Firefox 105.0.1 (x64 en-US)
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)
1 0 0

RegOpenKeyExW

 regkey_r: MozillaMaintenanceService
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
1 0 0

RegOpenKeyExW

 regkey_r: {3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}
1 0 0

RegOpenKeyExW

 regkey_r: {50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002A-0000-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0000-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002A-0409-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0409-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0116-0409-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0116-0409-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033
1 0 0

RegOpenKeyExW

 regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042
1 0 0

RegOpenKeyExW

 regkey_r: {A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}
1 0 0

RegOpenKeyExW

 regkey_r: {EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000001c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Adobe AIR
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: EditPlus
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: Google Chrome
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExW

 regkey_r: Haansoft HWord 80 Korean
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExW

 regkey_r: Office15.PROPLUSR
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExW

 regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExW

 regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExW

 regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExW

 regkey_r: {4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x0000001c
key_handle: 0x000002e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0
buffer Buffer with sha1: f3c32dfaa1bd4eea360d8c25abc4b8e50049ac49
buffer Buffer with sha1: e30c200529cb35be7c94de9dd2be170f6874b5ab
buffer Buffer with sha1: 7e3a6e66bc12a350ebbc08b06518cdf752c40ce2
host 5.42.64.17
host 77.91.68.63
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 126976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000230
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2168
region_size: 126976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000234
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 126976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000023c
1 0 0
Process injection Process 1648 manipulating memory of non-child process 2132
Process injection Process 1648 manipulating memory of non-child process 2168
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 126976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000230
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2168
region_size: 126976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000234
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@غ´ Í!¸LÍ!This program cannot be run in DOS mode. $ºN _þ/Î þ/Î þ/Î µWÊ ü/Î µWÈ ÿ/Î µWÏ ù/Î þ/Ï ö/Î êPÇ í/Î êP1 ÿ/Î êPÌ ÿ/Î Richþ/Î PELUYtdà $†2v‰ @ðdÈPàøÇ8 0.text—…† `.rdatax) *Š@@.dataÜд@À.rsrcøà¶@@
base_address: 0x00400000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

WriteProcessMemory

 buffer: D
base_address: 0x0041d000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

WriteProcessMemory

 buffer: €0€ H`à‘<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> </assembly>
base_address: 0x0041e000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2204
process_handle: 0x0000023c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@غ´ Í!¸LÍ!This program cannot be run in DOS mode. $ºN _þ/Î þ/Î þ/Î µWÊ ü/Î µWÈ ÿ/Î µWÏ ù/Î þ/Ï ö/Î êPÇ í/Î êP1 ÿ/Î êPÌ ÿ/Î Richþ/Î PELUYtdà $†2v‰ @ðdÈPàøÇ8 0.text—…† `.rdatax) *Š@@.dataÜд@À.rsrcøà¶@@
base_address: 0x00400000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0
Time & API Arguments Status Return Repeated

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 19.00 (x64)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HashTab 6.0.0.34
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Firefox (x64 en-US)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Maintenance Service
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5 KOR Language Pack
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 x64 Minimum Runtime - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office 64-bit Components 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0000-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared 64-bit MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0409-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0116-0409-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5 한국어 언어 팩
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Python 2.7.18 (64-bit)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 x64 Additional Runtime - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002e8
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0
Process injection Process 1648 called NtSetContextThread to modify thread in remote process 2204
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4229494
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000240
process_identifier: 2204
1 0 0
Process injection Process 1648 resumed a thread in remote process 2204
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000240
suspend_count: 1
process_identifier: 2204
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1648
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1648
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1648
1 0 0

CreateProcessInternalW

 thread_identifier: 2136
thread_handle: 0x0000022c
process_identifier: 2132
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\game.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\game.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000230
1 1 0

NtGetContextThread

 thread_handle: 0x0000022c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 126976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000230
3221225496 0

CreateProcessInternalW

 thread_identifier: 2172
thread_handle: 0x00000238
process_identifier: 2168
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\game.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\game.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000234
1 1 0

NtGetContextThread

 thread_handle: 0x00000238
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2168
region_size: 126976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000234
3221225496 0

CreateProcessInternalW

 thread_identifier: 2208
thread_handle: 0x00000240
process_identifier: 2204
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\game.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\game.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000023c
1 1 0

NtGetContextThread

 thread_handle: 0x00000240
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2204
region_size: 126976
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000023c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@غ´ Í!¸LÍ!This program cannot be run in DOS mode. $ºN _þ/Î þ/Î þ/Î µWÊ ü/Î µWÈ ÿ/Î µWÏ ù/Î þ/Ï ö/Î êPÇ í/Î êP1 ÿ/Î êPÌ ÿ/Î Richþ/Î PELUYtdà $†2v‰ @ðdÈPàøÇ8 0.text—…† `.rdatax) *Š@@.dataÜд@À.rsrcøà¶@@
base_address: 0x00400000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0041a000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

WriteProcessMemory

 buffer: D
base_address: 0x0041d000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

WriteProcessMemory

 buffer: €0€ H`à‘<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> </assembly>
base_address: 0x0041e000
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2204
process_handle: 0x0000023c
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4229494
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000240
process_identifier: 2204
1 0 0

NtResumeThread

 thread_handle: 0x00000240
suspend_count: 1
process_identifier: 2204
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
FireEye Generic.mg.e94ec358349808b1
Cylance unsafe
Sangfor Trojan.Win32.Cerbercrypt.Vdg4
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_90% (W)
VirIT Trojan.Win32.MSIL_Heur.A
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Generik.JQGLBFJ
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky HEUR:Trojan-PSW.MSIL.Raccoon.gen
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Nekark.cgbuu
TrendMicro Trojan.Win32.PRIVATELOADER.YXDFRZ
McAfee-GW-Edition Artemis!Trojan
Trapmine malicious.moderate.ml.score
SentinelOne Static AI - Suspicious PE
Webroot W32.Trojan.Gen
Avira TR/AD.Nekark.cgbuu
Antiy-AVL Trojan/Win32.CerberCrypt
Gridinsoft Spy.Win32.Raccoon.bot
Microsoft Trojan:Win32/CerberCrypt.C!MTB
ZoneAlarm HEUR:Trojan-PSW.MSIL.Raccoon.gen
GData Win32.Trojan-Stealer.Racealer.7J0L29
AhnLab-V3 Trojan/Win.PWSX-gen.C5442716
McAfee Artemis!E94EC3583498
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.2562615827
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.PRIVATELOADER.YXDFRZ
Rising Stealer.Raccoon!8.12279 (CLOUD)
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.AJAC!tr
BitDefenderTheta Gen:NN.ZemsilF.36250.vq0@ayOAX1f
AVG Win32:PWSX-gen [Trj]
Avast Win32:PWSX-gen [Trj]