popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

2111.exe

Raccoon Stealer Gen1 Malicious Library UPX Malicious Packer PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 30, 2023, 9:42 a.m. June 30, 2023, 9:44 a.m.
Size 50.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 175ac1e037521a1d29bffe5abe0d9d92
SHA256 5ff52ab9349cd6d7a7fc0d2596c3423cdfb5df668b363fb93bd686f9ab198910
CRC32 A7EBAEFA
ssdeep 768:TVcCo1dt4cybqx7P9vm9Rg6+E7apmW8msk:T2t4cybq56O84
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Raccoon_Stealer_1_Zero - Raccoon Stealer

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
89.208.107.176 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49161 -> 89.208.107.176:80 2036934 ET MALWARE Win32/RecordBreaker CnC Checkin M1 A Network Trojan was detected
TCP 89.208.107.176:80 -> 192.168.56.103:49161 2036955 ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response A Network Trojan was detected
TCP 192.168.56.103:49161 -> 89.208.107.176:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49161 -> 89.208.107.176:80 2044305 ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 89.208.107.176:80 -> 192.168.56.103:49161 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 89.208.107.176:80 -> 192.168.56.103:49163 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2044307 ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2044302 ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2044303 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2044306 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2044301 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49163 -> 89.208.107.176:80 2036884 ET HUNTING Possible Generic Stealer Sending System Information Misc activity

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://89.208.107.176/
suspicious_features Connection to IP address suspicious_request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
suspicious_features Connection to IP address suspicious_request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
suspicious_features Connection to IP address suspicious_request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
suspicious_features Connection to IP address suspicious_request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
suspicious_features Connection to IP address suspicious_request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
suspicious_features Connection to IP address suspicious_request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
suspicious_features Connection to IP address suspicious_request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://89.208.107.176/1eaae3b81d638c46a80f7e2ea4ea952c
request POST http://89.208.107.176/
request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
request GET http://89.208.107.176/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
request POST http://89.208.107.176/1eaae3b81d638c46a80f7e2ea4ea952c
request POST http://89.208.107.176/
request POST http://89.208.107.176/1eaae3b81d638c46a80f7e2ea4ea952c
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\LocalLow\msvcp140.dll
file C:\Users\test22\AppData\LocalLow\softokn3.dll
file C:\Users\test22\AppData\LocalLow\freebl3.dll
file C:\Users\test22\AppData\LocalLow\mozglue.dll
file C:\Users\test22\AppData\LocalLow\vcruntime140.dll
file C:\Users\test22\AppData\LocalLow\sqlite3.dll
file C:\Users\test22\AppData\LocalLow\nss3.dll
file C:\Users\test22\AppData\LocalLow\vcruntime140.dll
file C:\Users\test22\AppData\LocalLow\softokn3.dll
file C:\Users\test22\AppData\LocalLow\nss3.dll
file C:\Users\test22\AppData\LocalLow\msvcp140.dll
file C:\Users\test22\AppData\LocalLow\mozglue.dll
file C:\Users\test22\AppData\LocalLow\freebl3.dll
file C:\Users\test22\AppData\LocalLow\sqlite3.dll
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELöñ9bà"! à&Ð`ýÑ@Aø!\T¿@@x ¸Ph hýð ðÄ\”!@.textiÞà `.rdataäéðêä@@.dataNà*Î@À.00cfg0ø@@.rsrcx@ú@@.reloch P þ@BU‰åSWV‹] ‹u‹~ …ÿt@‹ pàÿ0WÿуÄ‹~ 1À…Û”ÀÁàH‰FD…ÿt‹ xàÿ0WÿуÄ1À^_[]Ã1À…Û”ÀÁàH‰FDëéÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åWVƒì‹uþ3'u7¿’èÿÿƒ=ta¡l‰$ÿ`ǃì…Àt:‰x(‰p,Ç@0ƒÄ^_]ÿ²èÿÿþ~2†çØÿÿƒø8wmÿ$…èx¿¦èÿÿë¨(ñ$èÀë´èI"똁þ揠ƒþoóƒþOIƒþ&ÅFþƒø†€ƒþ …!¿ÐèÿÿéIÿÿÿþ… ¿èÿÿé3ÿÿÿ¿­èÿÿé)ÿÿÿ¿¯èÿÿéÿÿÿ¿¶èÿÿéÿÿÿ¿´èÿÿé ÿÿÿ¿³èÿÿéÿÿÿ¿¢èÿÿé÷þÿÿ¿ èÿÿéíþÿÿ¿×èÿÿéãþÿÿþȏþ폿þå/þç„7þã…u¿Ñèÿÿéþÿÿþa …_¿™èÿÿé‡þÿÿþ“‘ƒþzƒþp„σþx….¿˜èÿÿéVþÿÿþ؏…þϏ߁þÉ…g¿£èÿÿé(þÿÿƒþkÖƒþP…a¿Éèÿÿé þÿÿþ½Êþî…J¿‘èÿÿéêýÿÿþ͏¾þ”„Aÿÿÿþ·t´é“þo¯þÙ…¿Ÿèÿÿé£ýÿÿƒþ'…¿¼èÿÿéýÿÿþæt þé…J¿“èÿÿérýÿÿƒþ{…èÿÿé_ýÿÿþÐ…æ¿ÙèÿÿéIýÿÿƒþl…忺èÿÿé6ýÿÿþ¾…Ú¿žèÿÿé ýÿÿþÎ…Ö¿Áèÿÿé ýÿÿþp„mþÿÿþq„aþÿÿþø…´¿ªèÿÿéÜüÿÿÿ$…˜x¿ÂèÿÿéËüÿÿþÏ…¿¤èÿÿéµüÿÿƒþW„Cÿÿÿëxþg„ þÿÿëjþßub¿ÓèÿÿéŠüÿÿƒþ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ٓ1Cò_ò_ò_)n°Ÿò_”ŠÌ‹ò_ò^"ò_Ϛ^žò_Ϛ\•ò_Ϛ[Óò_ϚZÑò_Ϛ_œò_Ϛ œò_Ϛ]œò_Richò_PEL›(Á[à"! (‚`Ù@ ð„@Ag‚Ïèr ðœ?°¬=`x8¸w@päÀc@.text’&( `.dataH)@,@À.idata¬pD@@.didat4X@À.rsrcð Z@@.reloc¬=°>^@B𢠢€¢à¢£0££p£0¤У°£¤À¤p¤P¤°¤ð¤à¤0¥`¥ ¥€¥P¥€¦À¦ ¦`¦ §à§À§€§°¨ð¨Ш ¨À©ªà©°©àª ««Àª¬@¬ ¬à«­P­0­­®¥ ¥€¢ ¢à¢ð¢£0£p££°£Ð£¤0¤P¤p¤°¤À¤à¤ð¤¥ ¥0¥P¥`¥€¥ ¥`¦€¦ ¦À¦€§ §À§à§ ¨°¨Ð¨ð¨°©À©à©ªÀªàª« «à«¬ ¬@¬­­0­P­®0®°®À¯аà°ð° ±À±²0²@²P²p²€²вP³€³³ð³ ´0µµ°µе¶P¶0·€·p¾€¿ ÀàÅðÆ0РÑÀÑàÑðÓÔÝ@ÞÐßàßààðæ0èPèÀêàêPïð ðò°òÐôðôpööû0ûÐû€üàüPýþàþ`ÿÀÿÐÿðÿ`€0` àÐP`°0P`Р°Ðð 0`pÀ °
request_handle: 0x00cc0018
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ÀÅäՄ¤Š†„¤Š†„¤Š†08e††¤Š†Ü†¤Š†„¤‹†¬¤Š†Ö̉‡—¤Š†Ö̎‡¤Š†Ö̏‡Ÿ¤Š†Ö̊‡…¤Š†ÖÌu†…¤Š†Ö̈‡…¤Š†Rich„¤Š†PEL•(Á[à"! ސÙð 0t(@Aàã ¸Œú?  € 8¸ @´.textôÜÞ `.dataôðâ@À.idata„ä@@.rsrcê@@.reloc  î@B0'à'`-à2@4p5°6(9ø9;0;À;<`= = >0>Q>–>p?Ð?ð?À@pA€DàEJ@ZðZ [0[`[°[\\ \0\@\pe°eàefPj`jpj€jjàj l0làlðmn0nPrÐrÐs`tÐtðtuuPu€u°u€vðvw w@w`w€w x`|}0}@}`}€} }À­Ð­à­ð­0®€À°ÀÐÀðÀ@Á Ò0Ò@ÒPÒàÓÔ ×Ð×°ØðؐÙ@Û°Ü@Ý0߀ߘ@ZX!fPjUnknown exception !fPjbad exceptionì!fPj8"fPj„"fPjAccess violation - no RTTI data!Attempted a typeid of nullptr pointer!Bad read pointer - no RTTI data!Bad dynamic_cast!csmà “8t°api-ms-win-core-fibers-l1-1-1api-ms-win-core-synch-l1-2-0kernel32api-ms-ext-ms-FlsAlloc
request_handle: 0x00cc0024
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELÔñ9bà"! V°/Ð íî @A­¼cQ ,p °r ¸€ 4C°Wh0  ؐ·.textÑ `.rdataœÿ0@@.data¸0  @À.00cfgP  @@.tls` " @À.rsrc°p $ @@.reloc4C€ D. @BU‰åSWVƒì‰Î‹]¡ 0 1è‰EðS芃ĉNjF9øs0ƒì ŠEìˆD$‰\$‰<$‰ñè>‰Æ‹Mð1éè‰ðƒÄ^_[]‰ىóƒør‹‰~WQSèJƒÄ Æ;ëËÌÌÌÌÌÌÌU‰åSWVƒì‹E…Àˆ¦‰Mð‹Y‰ÁƒÉ¾ÿÿÿ¸#€‰]ìxx‰ÚÑê‰×÷ÿÿÿ9ûwhÚ9щÖCñF=sH…À„ŽP葖ƒÄ‰Ç‹Eð‹]‰X‰p‰ÆSÿuWè¸ƒÄ Æ‹Mìƒùs4‰>‰ðƒÄ^_[] ƒøÜwF$ë1ÀHPèD–ƒÄx#ƒçà‰Güëªè“A‹ùr‹HüƒÀü)ȃø s‰ÈPè¡QƒÄ‹uðë¤1ÿ1öNésÿÿÿÿÔ ÌÌÌÌÌÌÌÌÌU‰åSWVÇ…Ò„­‰È‹ …É„¡€I‹z‰þƒæþ„¤‹…ÉtN‹YöÃtFƒãþ‰‹yƒç ÷‰yƒáþ‹rƒæ<‰z…Étv‹9ƒçþ ÷‰z‰‰‹rƒæþt‹^öÃu‰rëƒÏ‰z‹ƒÉ‰J‰‰0^_[]Ããþ‰^‹r‰÷ƒÏ‰zƒæþt&‹>ƒÏ‰z‰‰1ë×ÇhH ò€̹¶èkaƒÏ‰zÇhH ò€̹ èPaÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åSWVÇ…Ò„·‰È‹J…É„ª€I‹z‰þƒæþ„­‹N…Ét‹YöÃuƒÏ‰z‹NƒÉ‰J‰V‰0^_[]Ããþ‰^‹yƒç ÷‰yƒáþ‹rƒæ<‰z…Étd‹yƒçþ ÷‰z‰Q‰‹rƒæþt‹^öÃu‰r벃ãþ‰^‹r‰÷ƒÏ‰zƒæþt)‹~ƒÏ‰z‰V‰që‹ÇhH ò€̹¶èa`ƒÏ‰zÇhH ò€̹ èF`ÌÌÌÌÌU‰åSWVPÇ…Ò„„‹r…ö„y‰È‹N öÁ„†ƒáþ„Y‹y…ÿt öG …÷‹z ƒç ω~ €I ‹J…É„L‹q ƒæþ‰r‰Öƒæþ‹y ƒç ÷‰y ‰‹z
request_handle: 0x00cc0030
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL&ò9bà"! 6°à é @A4, S‡, È  xT ¸° 8$„& 0 ”. D.textÕ `.rdataÄ0@@.data<F@ & @À.00cfg ( @@.rsrcx  * @@.reloc8$° &. @BU‰åhOè2ƒÄ…Àt‰€8ƒÀƒàð]ÃhàÿÿèƒÄ1À]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌU‰åWV‹E…Àt‹u‹}‹U‹M …ÿt"òò€0ë(hàÿÿ迃ĸÿÿÿÿë&ǀ4¦¦¦¦Ç€0¦¦¦¦jVjjRQPèO¤ƒÄ^_]ÃÌÌÌÌÌÌÌÌU‰åSWVhOèƒÄ…Àt0‰Ç‰€8ƒÇ1öƒçðtk‹E‹U‹] ‹M…Ûtòò‡0ë%hàÿÿè2ƒÄ1öë<LJ4¦¦¦¦Ç‡0¦¦¦¦jRjjPQWèÅ£ƒÄ…Àtÿ·8èäƒÄë‰þ‰ð^_[]ÃÌÌÌÌÌU‰åWV‹u…öt ‹} jVèɨƒÄ…ÿtÿ¶8訃Ä^_]ÃU‰åSWVƒäøƒìP‰L$,‹M¡´@ 1è‰D$HÇD$4ƒùr‰Èƒàuy;}vhàÿÿé²hàÿÿ騃|$,„˜ƒ}„Ž‹u…ö„ƒ‰Ó‰øƒàøPèƒÄ…À„x‰|$ òòD$8‰ÂƒÂ‰D$$‹}WÁïVRèž‹L$0ƒÄ ÷߉|$01ÀÇD$ÇD$ÇD$ÇD$ÇD$ ÇD$ÇD$1Ûëf.„‹D$(ƒÀ€Ãÿƒø‰ñ„‰D$(€Ã¿ëa‰D$f„‹D$0D$8‹D$0D$9‹D$0D$:‹D$0D$;‹D$ 0D$<‹D$0D$=‹D$0D$>0\$?‹D$0øƒÀƒÇ€Ãƒø„,òùòD$@jD$<PjT$@RPÿt$@‰Î訃ĉ…À…JÿÿÿòD$@òþ„Û‰ñ…eÿÿÿ‹D$þÀ…Lÿÿÿ‹D$þÀu]‹D$ þÀuf‹D$þÀuw‹D$þÀ…Œ‹D$‰D$‹D$‰D$ÇD$ÇD$ÇD$ ÇD$ÇD$éôþÿÿ‰D$ÇD$éãþÿÿ‰D$ ÇD$ÇD$éÊþÿÿ‰D$ÇD$ÇD$ÇD$
request_handle: 0x00cc003c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL'ò9bà"! Ìò€Î¡Þ@AtvSÇwð°€Â¸À˜5hqà D{Œ.textVÊÌ `.rdata¬à®Ð@@.data˜ ~@À.00cfg †@@.rsrc€°ˆ@@.reloc˜5À6Œ@BU‰å¡ š…Àt‹ˆŒÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt‹ˆ$ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹Hÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt‹ˆ¨ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÌU‰å¡ š…Àt ‹H(ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹H,ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹H4ÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt‹ˆÀÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÏÌÌÌU‰å¡ š…Àt ‹H8ÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌU‰å¡ š…Àt ‹H<ÿ ]ÿáh 6hšÿè{ƒÄ…Àt]á šëÔÌÌÌÌÌÌÌÌU‰å¡ š…Àt ‹H@ÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹HDÿ ]ÿáh 6hšÿè{ƒÄ…Àt¸ÿÿÿÿ]á šëÏÌÌÌU‰å¡ š…Àt ‹HHÿ ]ÿáh 6hšÿè{ƒÄ…Àt1À]á šëÒÌÌÌÌÌÌ
request_handle: 0x00cc0048
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL"©,bv²à!  ú  àaȝ ° n*à Ð  ¨ à;  â Ð.text¬  `P`.data|' ( @`À.rdataDP F: @`@.bss(  €`À.edatan*° ,€ @0@.idataÐ à ¬ @0À.CRT,ð º @0À.tls ¼ @0À.rsrc¨ ¾ @0À.relocà; <Ä @0B/48`  @@B/19RÈp Ê @B/31]'@(Ð @B/45š-p.ø @B/57\   &@0B/70#°2@B/81s:À<6@B/92Pr@BSƒìÇ$€èˆó ‰Ã‰$è¶Ï …Û£ ¨ìa£¨ìat ǃÄ1À[Ãĸ[ÐWVSƒì‹T$$…Òur¡ ìa…ÀŽƒè1ۋ5 ãìa£ ìaëvÇ$èÿփ캉Øð±¨ìa…Àuᡨìaƒø„ãÇ$è7ó ¸ƒÄ[^_ ‰ö¼'ƒú¸uäd¡1ö‹X‹= ãìaëv9Ä Ç$èÿ׃ì‰ðð±¨ìa…ÀuÞ1Û¡¨ìaƒø„!¡¨ìa…À„ñ¡¨ìaƒø„…Û„Ë¡Šìa…Àt‹T$(ÇD$‰T$‹T$ ‰$ÿÐƒì ƒ ìaƒÄ¸[^_ 1Àé7ÿÿÿ‰ö¼'¡ ¨ìa‰$è3Î …À‰ÆtA¡¨ìa‰$è Î ‰Ãƒë9Þw‹…ÀtóƒëÿÐ9Þvñ‰4$èèñ ǨìaÇ ¨ìa1ÀǨìa‡¨ìa¸ƒÄ[^_ »éÿÿÿf
request_handle: 0x00cc0054
1 1 0
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000001c
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: HashTab
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Firefox 105.0.1 (x64 en-US)
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)
1 0 0

RegOpenKeyExW

 regkey_r: MozillaMaintenanceService
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
1 0 0

RegOpenKeyExW

 regkey_r: {3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}
1 0 0

RegOpenKeyExW

 regkey_r: {50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002A-0000-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0000-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002A-0409-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0409-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0116-0409-1000-0000000FF1CE}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0116-0409-1000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033
1 0 0

RegOpenKeyExW

 regkey_r: {92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042
1 0 0

RegOpenKeyExW

 regkey_r: {A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}
1 0 0

RegOpenKeyExW

 regkey_r: {EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020119
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}
1 0 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000001c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Adobe AIR
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: EditPlus
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: Google Chrome
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExW

 regkey_r: Haansoft HWord 80 Korean
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExW

 regkey_r: Office15.PROPLUSR
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExW

 regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExW

 regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExW

 regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExW

 regkey_r: {4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x0000001c
key_handle: 0x000002dc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0
host 89.208.107.176
Time & API Arguments Status Return Repeated

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 19.00 (x64)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HashTab 6.0.0.34
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashTab\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Firefox (x64 en-US)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.1 (x64 en-US)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Maintenance Service
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5 KOR Language Pack
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3160A0D4-A4F3-39B4-B4CC-B5306F9CF9B3}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 x64 Minimum Runtime - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office 64-bit Components 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0000-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared 64-bit MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002A-0409-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0116-0409-1000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft .NET Framework 4.5 한국어 언어 팩
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1042\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Python 2.7.18 (64-bit)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5F504DF-2ED9-4A2D-A2F3-9D2750DD42D6}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 x64 Additional Runtime - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000002dc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0
Bkav W32.AIDetectMalware
MicroWorld-eScan Gen:Variant.Lazy.294038
ALYac Gen:Variant.Lazy.294038
Malwarebytes Spyware.PasswordStealer
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
K7GW Password-Stealer ( 005935101 )
K7AntiVirus Password-Stealer ( 005935101 )
Arcabit Trojan.Lazy.D47C96
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/PSW.Agent.OOQ
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky VHO:Trojan-PSW.Win32.Raccoon.gen
BitDefender Gen:Variant.Lazy.294038
Avast Win32:PWSX-gen [Trj]
Emsisoft Gen:Variant.Lazy.294038 (B)
F-Secure Heuristic.HEUR/AGEN.1316207
VIPRE Gen:Variant.Lazy.294038
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.175ac1e037521a1d
Sophos ML/PE-A
Avira HEUR/AGEN.1316207
MAX malware (ai score=84)
Antiy-AVL Trojan[PSW]/Win32.Agent
Microsoft Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm VHO:Trojan-PSW.Win32.Raccoon.gen
GData Gen:Variant.Lazy.294038
AhnLab-V3 Trojan/Win.Generic.C5445766
TACHYON Trojan-PWS/W32.Raccoon.51712
VBA32 BScope.TrojanPSW.Racealer
Cylance unsafe
Rising Stealer.Agent!8.C2 (TFE:4:At9cuQQ5xMH)
MaxSecure Trojan.Malware.300983.susgen
BitDefenderTheta AI:Packer.DD668EAA1E
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.037521
DeepInstinct MALICIOUS